Splunk Search

How to calculate percentages for multi valued search

xvxt006
Contributor

Hi,

I am getting requests by host (if we have 20 hosts) then i have 20 values. Now i want to calculate the percentage delta for each host with the average number of requests for all the host. So i got the average hosts for all the hosts and using stats i got the requests per each host. But now how do i calculate percentage delta for each host. Here is the query i have.
i have eval RequestsPctDelta = ((RequestPerHost-AverageRequests)/AverageRequests)*100
but i need somekind of for loop so that i get the RequestsPctDelta for each host? any suggestions would help a lot. Thank you.

| stats count as requests | eval AverageRequests= requests/20 | stats count as RequestPerHost by host | eval RequestsPctDelta = ((RequestPerHost-AverageRequests)/AverageRequests)*100 | table RequestsPctDelta

Tags (1)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Something like this?

base search | stats count by host | eventstats avg(count) as avg | eval delta = ((count/avg-1)*100)."%"

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Something like this?

base search | stats count by host | eventstats avg(count) as avg | eval delta = ((count/avg-1)*100)."%"

xvxt006
Contributor

Thank you so much Marti. This is what i wanted.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...