Splunk Search

How to do the division of 2 values in the same field

Julia1231
Explorer

Hi,

I have a table like this:

id       value

1            12

2             10

I want to do this calculation by splunk: (10/12)*100% (means value  of second id / value of the first id)*100%

How do I do, please?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Calculations are done between fields in events so the first thing you need to do is get both values into the same event. There a number of ways to do this. If you only have two events, try this:

| stats list(value) as value
| eval percent=100*mvindex(value,1)/mvindex(value,0)

View solution in original post

Julia1231
Explorer

It works well,

Thank you!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Calculations are done between fields in events so the first thing you need to do is get both values into the same event. There a number of ways to do this. If you only have two events, try this:

| stats list(value) as value
| eval percent=100*mvindex(value,1)/mvindex(value,0)

Julia1231
Explorer

Hi @ITWhisperer ,

What can I do when there are more than 2 values, please?

id       value

1            12

2             10

3              15

4              20

 

Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

mvindex uses index into the multivalue field, starting at 0, so if you wanted to calculate the percentage for id 3 and 4 you would do something like this

| stats list(value) as value
| eval percent=100*mvindex(value,3)/mvindex(value,2)
0 Karma

Julia1231
Explorer

@ITWhisperer 
When doing it, I have this error: Error in 'eval' command: Type checking failed. '*' only takes numbers.

And I have to define 2 variable to store each value and it works.... Do you know why?

| stats list(value) as value
|eval n= mvindex(value,3)
|eval m= mvindex(value,2)
|eval percent=100*n/m

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

mvindex is probably returning a string so either do it the way you are or use the tonumber function

| stats list(value) as value
|eval percent=100*tonumber(mvindex(value,3))/tonumber(mvindex(value,2))
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...