Splunk Search

How to calculate percentages for multi valued search

xvxt006
Contributor

Hi,

I am getting requests by host (if we have 20 hosts) then i have 20 values. Now i want to calculate the percentage delta for each host with the average number of requests for all the host. So i got the average hosts for all the hosts and using stats i got the requests per each host. But now how do i calculate percentage delta for each host. Here is the query i have.
i have eval RequestsPctDelta = ((RequestPerHost-AverageRequests)/AverageRequests)*100
but i need somekind of for loop so that i get the RequestsPctDelta for each host? any suggestions would help a lot. Thank you.

| stats count as requests | eval AverageRequests= requests/20 | stats count as RequestPerHost by host | eval RequestsPctDelta = ((RequestPerHost-AverageRequests)/AverageRequests)*100 | table RequestsPctDelta

Tags (1)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Something like this?

base search | stats count by host | eventstats avg(count) as avg | eval delta = ((count/avg-1)*100)."%"

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Something like this?

base search | stats count by host | eventstats avg(count) as avg | eval delta = ((count/avg-1)*100)."%"

xvxt006
Contributor

Thank you so much Marti. This is what i wanted.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...