Splunk Search

How to divide 2 distinct counts of aggregated values using eval?

New Member


I'm new to splunk and not able to figure out the solution to the problem below.
Query: |eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| stats dc(id) by action

From the above query, I get the count for values aggregated under group1 and group2. I would also want a field which calculates value for dc("group1") divided upon by dc("group2").

Please let me know how to get it.

Tags (3)
0 Karma

Path Finder

I think that this will have to help you.
You should initially count all the values of Group1 and Group2, then to make a division.
grou1:|eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| where action="goup1"| stats c by action as GROUP1
group2:|eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| where action="goup2"| stats c by action as GROUP2
divisioneval Division=GROUP1/GROUP2]

General solution:|eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| where action="goup1"| stats c by action as GROUP1|appencolds [search ...|eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| where action="goup2"|stats c by action as GROUP2]| eval Division=GROUP1/GROUP2

0 Karma


Can you provide sample data and sample results? Not sure what exactly you are looking for.

In terms of your dc(group1) / dc(group2), it doesn't work that way, because group1 and group2 are values of the field "action". Distinct count of action [dc(action)], would return only 1 for group1, 1 for group2, and 1 for any other action value you have in the action field.

Are you trying to count the number of results that are action=group1 and the results that are action=group2? For this you can just pipe into "stats count by action", or simply add count after your "dc(id)" to also get the count by action.

Hope this helps

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...