How to do the division of 2 values in the same field

[Julia1231]

Hi,

I have a table like this:

id       value

1            12

2             10

I want to do this calculation by splunk: (10/12)*100% (means value  of second id / value of the first id)*100%

How do I do, please?

[Julia1231]

It works well,

Thank you!

[ITWhisperer · Accepted solution]

Calculations are done between fields in events so the first thing you need to do is get both values into the same event. There a number of ways to do this. If you only have two events, try this:

| stats list(value) as value
| eval percent=100*mvindex(value,1)/mvindex(value,0)

[Julia1231]

Hi @ITWhisperer ,

What can I do when there are more than 2 values, please?

id       value

1            12

2             10

3              15

4              20

Thanks

[ITWhisperer]

mvindex uses index into the multivalue field, starting at 0, so if you wanted to calculate the percentage for id 3 and 4 you would do something like this

| stats list(value) as value
| eval percent=100*mvindex(value,3)/mvindex(value,2)

[Julia1231]

@ITWhisperer 
When doing it, I have this error: Error in 'eval' command: Type checking failed. '*' only takes numbers.

And I have to define 2 variable to store each value and it works.... Do you know why?

| stats list(value) as value
|eval n= mvindex(value,3)
|eval m= mvindex(value,2)
|eval percent=100*n/m

[ITWhisperer]

mvindex is probably returning a string so either do it the way you are or use the tonumber function

| stats list(value) as value
|eval percent=100*tonumber(mvindex(value,3))/tonumber(mvindex(value,2))