Splunk Search

How to compare and generate percentage from two lookup fields?

Minasdad
Path Finder

file1.csv and file2.csv with a common field of "Tests". Wanting to compare File2 field "Tests" against file1.csv field "Tests" and generate a percentage. Example file1.csv has 4 test vs. file2.csv with 2, generating a percentage of 50%.

Labels (1)
0 Karma
1 Solution

marysan
Communicator

| inputlookup file1.csv 
| eventstats dc(Tests) as file1_tests_count
| dedup file1_tests_count
| inputlookup append=T  file2.csv
| eventstats dc(Tests) as file2_tests_count
| dedup file2_tests_count
| fields file1_tests_count,file2_tests_count
| eval percentage=(file1_tests_count/file2_tests_count*100)

View solution in original post

Tags (2)

marysan
Communicator

| inputlookup file1.csv 
| eventstats dc(Tests) as file1_tests_count
| dedup file1_tests_count
| inputlookup append=T  file2.csv
| eventstats dc(Tests) as file2_tests_count
| dedup file2_tests_count
| fields file1_tests_count,file2_tests_count
| eval percentage=(file1_tests_count/file2_tests_count*100)

Tags (2)

gcusello
SplunkTrust
SplunkTrust

Hi  @Minasdad,

let me understand: you want to display the persentage of the count of lookup2 respect lookup1, is it correct?

I f this is your need, please try this:

| inputlookup file1.csv
| stats count 
| eval lookup=file2
| append [ 
   | inputlookup file1.csv
   | stats count
   | eval lookup=file2
   ]
| transpose header_field=lookup
| eval perc=round(file2/file1*100,2)
| table perc

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...