Splunk Search

## How to do the division of 2 values in the same field

Explorer

Hi,

I have a table like this:

id       value

1            12

2             10

I want to do this calculation by splunk: (10/12)*100% (means value  of second id / value of the first id)*100%

How do I do, please?

Labels (1)
• ### Other

1 Solution
SplunkTrust

Calculations are done between fields in events so the first thing you need to do is get both values into the same event. There a number of ways to do this. If you only have two events, try this:

``````| stats list(value) as value
| eval percent=100*mvindex(value,1)/mvindex(value,0)``````
Explorer

It works well,

Thank you!

SplunkTrust

Calculations are done between fields in events so the first thing you need to do is get both values into the same event. There a number of ways to do this. If you only have two events, try this:

``````| stats list(value) as value
| eval percent=100*mvindex(value,1)/mvindex(value,0)``````
Explorer

Hi @ITWhisperer ,

What can I do when there are more than 2 values, please?

id       value

1            12

2             10

3              15

4              20

Thanks

SplunkTrust

mvindex uses index into the multivalue field, starting at 0, so if you wanted to calculate the percentage for id 3 and 4 you would do something like this

``````| stats list(value) as value
| eval percent=100*mvindex(value,3)/mvindex(value,2)``````
Explorer

@ITWhisperer
When doing it, I have this error: Error in 'eval' command: Type checking failed. '*' only takes numbers.

And I have to define 2 variable to store each value and it works.... Do you know why?

``````| stats list(value) as value
|eval n= mvindex(value,3)
|eval m= mvindex(value,2)
|eval percent=100*n/m``````

SplunkTrust

mvindex is probably returning a string so either do it the way you are or use the tonumber function

``````| stats list(value) as value
|eval percent=100*tonumber(mvindex(value,3))/tonumber(mvindex(value,2))``````
Get Updates on the Splunk Community!

#### Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

#### Maximize the Value from Microsoft Defender with Splunk

Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

#### This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...