Splunk Search

How do you perform a mathematical calculation on the results of two queries?

moizmmz
Path Finder

Hello,

I have two queries:
1. index=abc slice_played slicer=Latency externalUserID="$ext$" assetID="806d682119ac46d18b9f4a5f3dc20b10"
| dedup time, sessionID
| stats sum(duration) as "x_seconds"

Let's say the result is x

  1. index=abc slice_played slicer=Latency externalUserID="$ext$" assetID!="806d682119ac46d18b9f4a5f3dc20b10" assetID!="5c117f3141244a3a9d6899395b5c65aa" assetID!="d4da85ca8a474316a958a1d164d51483" | dedup time, sessionID | stats sum(duration) as "y_seconds"

Let's say the result is y

So all I want to do is (x/y)*100 and show the result. Please help!!

Tags (2)
0 Karma
1 Solution

ragedsparrow
Contributor

Does something like this work?

index=abc slice_played slicer=Latency externalUserID="$ext$" assetID="806d682119ac46d18b9f4a5f3dc20b10" 
| dedup time, sessionID 
| stats sum(duration) as "x_seconds" 
| appendcols 
    [ index=abc slice_played slicer=Latency externalUserID="$ext$" assetID!="806d682119ac46d18b9f4a5f3dc20b10" assetID!="5c117f3141244a3a9d6899395b5c65aa" assetID!="d4da85ca8a474316a958a1d164d51483" 
    | dedup time, sessionID 
    | stats sum(duration) as "y_seconds"] 
| eval Result=(x_seconds/y_seconds)*100
| fields Result

That is how I would start.

View solution in original post

ragedsparrow
Contributor

Does something like this work?

index=abc slice_played slicer=Latency externalUserID="$ext$" assetID="806d682119ac46d18b9f4a5f3dc20b10" 
| dedup time, sessionID 
| stats sum(duration) as "x_seconds" 
| appendcols 
    [ index=abc slice_played slicer=Latency externalUserID="$ext$" assetID!="806d682119ac46d18b9f4a5f3dc20b10" assetID!="5c117f3141244a3a9d6899395b5c65aa" assetID!="d4da85ca8a474316a958a1d164d51483" 
    | dedup time, sessionID 
    | stats sum(duration) as "y_seconds"] 
| eval Result=(x_seconds/y_seconds)*100
| fields Result

That is how I would start.

moizmmz
Path Finder

Yes it does!!! Thank you!! 🙂

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...