Splunk Search

How to calculate percentages for multi valued search

xvxt006
Contributor

Hi,

I am getting requests by host (if we have 20 hosts) then i have 20 values. Now i want to calculate the percentage delta for each host with the average number of requests for all the host. So i got the average hosts for all the hosts and using stats i got the requests per each host. But now how do i calculate percentage delta for each host. Here is the query i have.
i have eval RequestsPctDelta = ((RequestPerHost-AverageRequests)/AverageRequests)*100
but i need somekind of for loop so that i get the RequestsPctDelta for each host? any suggestions would help a lot. Thank you.

| stats count as requests | eval AverageRequests= requests/20 | stats count as RequestPerHost by host | eval RequestsPctDelta = ((RequestPerHost-AverageRequests)/AverageRequests)*100 | table RequestsPctDelta

Tags (1)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Something like this?

base search | stats count by host | eventstats avg(count) as avg | eval delta = ((count/avg-1)*100)."%"

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Something like this?

base search | stats count by host | eventstats avg(count) as avg | eval delta = ((count/avg-1)*100)."%"

xvxt006
Contributor

Thank you so much Marti. This is what i wanted.

0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...