Splunk Search

## How to perfom math calculations

Engager

I am trying to figure out how to take two searches and divide their results to create a dial chart showing the percentage of breached records.

index=itsm sourcetype=sm9_incident | dedup NUMBER | search assignmentGroup="WG1555" AND isBreached="t" AND status="Closed" |stats count

index=itsm sourcetype=sm9_incident | dedup NUMBER | search assignmentGroup="WG1555" AND status="Closed" | stats count

Tags (2)
1 Solution
SplunkTrust

Hi bvenom28,

try something like this:

index=itsm sourcetype=sm9_incident assignmentGroup="WG1555" | dedup NUMBER | eventstats count(eval(isBreached="t" AND status="Closed")) as isBreachedCount count(eval(status="Closed")) as ClosedCount | eval myPrec=isBreachedCount*100/ClosedCount | table myPrec

cheers, MuS

Builder

bvenom28,

your searches where really not well formed:

index=itsm sourcetype=sm9_incident | dedup NUMBER | search assignmentGroup="WG1555" AND isBreached="t" AND status="Closed" |stats count

The search terms should always be places at the beginning of the search, unless you really need to filter out results based on same valued calculated in a stats or eval statement.

As correctly MuS wrote, the assignmentGroup="WG1555" condition has been placed right at the beginning, and he wisely used the "count(eval('condition')) trick to summarize values of events matching a certain condition.

marco

SplunkTrust

Hi bvenom28,

try something like this:

index=itsm sourcetype=sm9_incident assignmentGroup="WG1555" | dedup NUMBER | eventstats count(eval(isBreached="t" AND status="Closed")) as isBreachedCount count(eval(status="Closed")) as ClosedCount | eval myPrec=isBreachedCount*100/ClosedCount | table myPrec

cheers, MuS

Splunk Employee

bvenom28, i recommend you check out the search and reporting class offered by the Splunk EDU team, it's a good way to get started!

Engager

Wow that worked perfect. I have alot to learn. Thanks!!!!

Get Updates on the Splunk Community!

#### Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

#### Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

#### Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...