Splunk Search

How to get a percentage calculation ?

zacksoft
Contributor

I am writing a query which is going to a scheduled report. I have 3 servers/hosts (serv1, serv2, serv3) whose average response time i am calculating like this,

timechart span=1d eval(round(avg(req_time_seconds),2)) as avgresponse_time by host

I am looking for an output that should do a comparison of serv1 with other two and give me a result like below,

Serv1's avg_resp_time is 20 % higher than Serv2
Serv1's avg_resp_time is 10 % higher than Serv3

something like this.. I don't want an absolute value but a percent value and how much it is higher than Serv1.

0 Karma
1 Solution

to4kawa
Ultra Champion
....
| timechart span=1d eval(round(avg(req_time_seconds),2)) as avgresponse_time by host
| eval result1="Serv1's avg_resp_time is ".case(serv1>serv2,(round(serv1/serv2*100))."% higher than Serv2", serv1<serv2,(round(serv2/serv1*100))."% lower than Serv2", true(), "same with Serv2")
| eval result2="Serv1's avg_resp_time is ".case(serv1>serv3,(round(serv1/serv3*100))."% higher than Serv3", serv1<serv3,(round(serv3/serv1*100))."% lower than Serv3", true(), "same with Serv3")

View solution in original post

0 Karma

to4kawa
Ultra Champion
....
| timechart span=1d eval(round(avg(req_time_seconds),2)) as avgresponse_time by host
| eval result1="Serv1's avg_resp_time is ".case(serv1>serv2,(round(serv1/serv2*100))."% higher than Serv2", serv1<serv2,(round(serv2/serv1*100))."% lower than Serv2", true(), "same with Serv2")
| eval result2="Serv1's avg_resp_time is ".case(serv1>serv3,(round(serv1/serv3*100))."% higher than Serv3", serv1<serv3,(round(serv3/serv1*100))."% lower than Serv3", true(), "same with Serv3")
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...