Splunk Search

How to calculate percentages for multi valued search

xvxt006
Contributor

Hi,

I am getting requests by host (if we have 20 hosts) then i have 20 values. Now i want to calculate the percentage delta for each host with the average number of requests for all the host. So i got the average hosts for all the hosts and using stats i got the requests per each host. But now how do i calculate percentage delta for each host. Here is the query i have.
i have eval RequestsPctDelta = ((RequestPerHost-AverageRequests)/AverageRequests)*100
but i need somekind of for loop so that i get the RequestsPctDelta for each host? any suggestions would help a lot. Thank you.

| stats count as requests | eval AverageRequests= requests/20 | stats count as RequestPerHost by host | eval RequestsPctDelta = ((RequestPerHost-AverageRequests)/AverageRequests)*100 | table RequestsPctDelta

Tags (1)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Something like this?

base search | stats count by host | eventstats avg(count) as avg | eval delta = ((count/avg-1)*100)."%"

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Something like this?

base search | stats count by host | eventstats avg(count) as avg | eval delta = ((count/avg-1)*100)."%"

xvxt006
Contributor

Thank you so much Marti. This is what i wanted.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...