Splunk Search

How to compute results using rows /cells from a table?

andres91302
Communicator

Hello Friends, 

I'm trying to generate a table that summarizes the total count of events A, B and C as follows

 

search 1 | fields A 
| stats  count(A) as Net 
| eval stage="A"
| append 
    [ search search 2 | fields B
    | stats count(B) as Net 
    | eval stage="B"] 
| append 
    [ search search 3 | fields C
    | stats count(C) as Net 
    | eval stage="C"] 
| table stage, Net

 

But I cannot seem to find a way to the create a field named "conv" that will compute the follow opeacion:

take the value of the current Net count subtract the previous value and then devide it by the previous value, in other words find the percentage of conversion between stages, BUT for thw first row it will be zero something like this:


StageNetconv
A1000
B80(80- 100)/100  = -0.2  
C70(70-80) /80 = -0.125 


I was thinking about a way to calculate something with a for loop? but I dont know how ti access the indexes of the table... Thank you so much to everyone that can help me like THANK YOU SO MUCH

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats values(Net) as previous window=1 current=f
| eval conv=(Net-previous)/previous

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats values(Net) as previous window=1 current=f
| eval conv=(Net-previous)/previous

andres91302
Communicator

@ITWhisperer  thank you for your great help! it means a lot to me, your code worked as expected 10/10 I will reading documenaton of streamstats and eventstats to use them in the futurethank you so much again, thanks a lot

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...