Splunk Search

How to create a search that will use values from a table to calculate the percentage?

pahilw
Explorer

I have a search that outputs a number of log lines in following table format:

package      |          lineCount
_____________________________
OLD          |            333
NEW          |            120

This is the intermediate state of my data as i am looking for the percent change in number of log lines. Hence, i want to use the values from table and do some calculations for getting percent (for example (120 - 333) / 333 to calculate decrease %). I am not able to figure out how do i extract the values and use them for doing calculations. What command to use, etc?

1 Solution

gokadroid
Motivator

Can you try this:

your base query to return the table of package, lineCount
| eval dummy=""
| xyseries dummy, package, lineCount
| eval percentage=(NEW-OLD)/OLD
| table NEW, OLD, percentage

View solution in original post

gokadroid
Motivator

Can you try this:

your base query to return the table of package, lineCount
| eval dummy=""
| xyseries dummy, package, lineCount
| eval percentage=(NEW-OLD)/OLD
| table NEW, OLD, percentage

pahilw
Explorer

worked like a charm, exactly what i was looking for. Thank you.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...