Splunk Search

How to calculate percentages for multi valued search

xvxt006
Contributor

Hi,

I am getting requests by host (if we have 20 hosts) then i have 20 values. Now i want to calculate the percentage delta for each host with the average number of requests for all the host. So i got the average hosts for all the hosts and using stats i got the requests per each host. But now how do i calculate percentage delta for each host. Here is the query i have.
i have eval RequestsPctDelta = ((RequestPerHost-AverageRequests)/AverageRequests)*100
but i need somekind of for loop so that i get the RequestsPctDelta for each host? any suggestions would help a lot. Thank you.

| stats count as requests | eval AverageRequests= requests/20 | stats count as RequestPerHost by host | eval RequestsPctDelta = ((RequestPerHost-AverageRequests)/AverageRequests)*100 | table RequestsPctDelta

Tags (1)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Something like this?

base search | stats count by host | eventstats avg(count) as avg | eval delta = ((count/avg-1)*100)."%"

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Something like this?

base search | stats count by host | eventstats avg(count) as avg | eval delta = ((count/avg-1)*100)."%"

xvxt006
Contributor

Thank you so much Marti. This is what i wanted.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...