Splunk Search

How do you perform a mathematical calculation on the results of two queries?

moizmmz
Path Finder

Hello,

I have two queries:
1. index=abc slice_played slicer=Latency externalUserID="$ext$" assetID="806d682119ac46d18b9f4a5f3dc20b10"
| dedup time, sessionID
| stats sum(duration) as "x_seconds"

Let's say the result is x

  1. index=abc slice_played slicer=Latency externalUserID="$ext$" assetID!="806d682119ac46d18b9f4a5f3dc20b10" assetID!="5c117f3141244a3a9d6899395b5c65aa" assetID!="d4da85ca8a474316a958a1d164d51483" | dedup time, sessionID | stats sum(duration) as "y_seconds"

Let's say the result is y

So all I want to do is (x/y)*100 and show the result. Please help!!

Tags (2)
0 Karma
1 Solution

ragedsparrow
Contributor

Does something like this work?

index=abc slice_played slicer=Latency externalUserID="$ext$" assetID="806d682119ac46d18b9f4a5f3dc20b10" 
| dedup time, sessionID 
| stats sum(duration) as "x_seconds" 
| appendcols 
    [ index=abc slice_played slicer=Latency externalUserID="$ext$" assetID!="806d682119ac46d18b9f4a5f3dc20b10" assetID!="5c117f3141244a3a9d6899395b5c65aa" assetID!="d4da85ca8a474316a958a1d164d51483" 
    | dedup time, sessionID 
    | stats sum(duration) as "y_seconds"] 
| eval Result=(x_seconds/y_seconds)*100
| fields Result

That is how I would start.

View solution in original post

ragedsparrow
Contributor

Does something like this work?

index=abc slice_played slicer=Latency externalUserID="$ext$" assetID="806d682119ac46d18b9f4a5f3dc20b10" 
| dedup time, sessionID 
| stats sum(duration) as "x_seconds" 
| appendcols 
    [ index=abc slice_played slicer=Latency externalUserID="$ext$" assetID!="806d682119ac46d18b9f4a5f3dc20b10" assetID!="5c117f3141244a3a9d6899395b5c65aa" assetID!="d4da85ca8a474316a958a1d164d51483" 
    | dedup time, sessionID 
    | stats sum(duration) as "y_seconds"] 
| eval Result=(x_seconds/y_seconds)*100
| fields Result

That is how I would start.

moizmmz
Path Finder

Yes it does!!! Thank you!! 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...