Splunk Search

How to create a search that will use values from a table to calculate the percentage?

pahilw
Explorer

I have a search that outputs a number of log lines in following table format:

package      |          lineCount
_____________________________
OLD          |            333
NEW          |            120

This is the intermediate state of my data as i am looking for the percent change in number of log lines. Hence, i want to use the values from table and do some calculations for getting percent (for example (120 - 333) / 333 to calculate decrease %). I am not able to figure out how do i extract the values and use them for doing calculations. What command to use, etc?

1 Solution

gokadroid
Motivator

Can you try this:

your base query to return the table of package, lineCount
| eval dummy=""
| xyseries dummy, package, lineCount
| eval percentage=(NEW-OLD)/OLD
| table NEW, OLD, percentage

View solution in original post

gokadroid
Motivator

Can you try this:

your base query to return the table of package, lineCount
| eval dummy=""
| xyseries dummy, package, lineCount
| eval percentage=(NEW-OLD)/OLD
| table NEW, OLD, percentage

pahilw
Explorer

worked like a charm, exactly what i was looking for. Thank you.

Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...