Hi,
I'm new to splunk and not able to figure out the solution to the problem below.
Query: |eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| stats dc(id) by action
From the above query, I get the count for values aggregated under group1 and group2. I would also want a field which calculates value for dc("group1") divided upon by dc("group2").
Please let me know how to get it.
hi,
I think that this will have to help you.
You should initially count all the values of Group1 and Group2, then to make a division.
grou1:|eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| where action="goup1"| stats c by action as GROUP1
group2:|eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| where action="goup2"| stats c by action as GROUP2
divisioneval Division=GROUP1/GROUP2]
General solution:|eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| where action="goup1"| stats c by action as GROUP1|appencolds [search ...|eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| where action="goup2"|stats c by action as GROUP2]| eval Division=GROUP1/GROUP2
Can you provide sample data and sample results? Not sure what exactly you are looking for.
In terms of your dc(group1) / dc(group2), it doesn't work that way, because group1 and group2 are values of the field "action". Distinct count of action [dc(action)], would return only 1 for group1, 1 for group2, and 1 for any other action value you have in the action field.
Are you trying to count the number of results that are action=group1 and the results that are action=group2? For this you can just pipe into "stats count by action", or simply add count after your "dc(id)" to also get the count by action.
Hope this helps