How to divide 2 distinct counts of aggregated values using eval?

[fayazvf]

Hi,

I'm new to splunk and not able to figure out the solution to the problem below.
Query: |eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| stats dc(id) by action

From the above query, I get the count for values aggregated under group1 and group2. I would also want a field which calculates value for dc("group1") divided upon by dc("group2").

Please let me know how to get it.

[Tanefo]

hi,
I think that this will have to help you.
You should initially count all the values of Group1 and Group2, then to make a division.
grou1:|eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| where action="goup1"| stats c by action as GROUP1
group2:|eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| where action="goup2"| stats c by action as GROUP2
divisioneval Division=GROUP1/GROUP2]

General solution:|eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| where action="goup1"| stats c by action as GROUP1|appencolds [search ...|eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| where action="goup2"|stats c by action as GROUP2]| eval Division=GROUP1/GROUP2

[aholzer]

Can you provide sample data and sample results? Not sure what exactly you are looking for.

In terms of your dc(group1) / dc(group2), it doesn't work that way, because group1 and group2 are values of the field "action". Distinct count of action [dc(action)], would return only 1 for group1, 1 for group2, and 1 for any other action value you have in the action field.

Are you trying to count the number of results that are action=group1 and the results that are action=group2? For this you can just pipe into "stats count by action", or simply add count after your "dc(id)" to also get the count by action.

Hope this helps