Splunk Search

## How to do the division of 2 values in the same field Explorer

Hi,

I have a table like this:

id       value

1            12

2             10

I want to do this calculation by splunk: (10/12)*100% (means value  of second id / value of the first id)*100%

Labels (1)
• ### Other

1 Solution  SplunkTrust

Calculations are done between fields in events so the first thing you need to do is get both values into the same event. There a number of ways to do this. If you only have two events, try this:

``````| stats list(value) as value
| eval percent=100*mvindex(value,1)/mvindex(value,0)`````` Explorer

It works well,

Thank you!  SplunkTrust

Calculations are done between fields in events so the first thing you need to do is get both values into the same event. There a number of ways to do this. If you only have two events, try this:

``````| stats list(value) as value
| eval percent=100*mvindex(value,1)/mvindex(value,0)`````` Explorer

Hi @ITWhisperer ,

What can I do when there are more than 2 values, please?

id       value

1            12

2             10

3              15

4              20

Thanks  SplunkTrust

mvindex uses index into the multivalue field, starting at 0, so if you wanted to calculate the percentage for id 3 and 4 you would do something like this

``````| stats list(value) as value
| eval percent=100*mvindex(value,3)/mvindex(value,2)`````` Explorer

@ITWhisperer
When doing it, I have this error: Error in 'eval' command: Type checking failed. '*' only takes numbers.

And I have to define 2 variable to store each value and it works.... Do you know why?

``````| stats list(value) as value
|eval n= mvindex(value,3)
|eval m= mvindex(value,2)
|eval percent=100*n/m``````  SplunkTrust

mvindex is probably returning a string so either do it the way you are or use the tonumber function

``````| stats list(value) as value
|eval percent=100*tonumber(mvindex(value,3))/tonumber(mvindex(value,2))`````` Get Updates on the Splunk Community!