Splunk Search

How to perfom math calculations

bvenom28
Engager

I am trying to figure out how to take two searches and divide their results to create a dial chart showing the percentage of breached records.

index=itsm sourcetype=sm9_incident | dedup NUMBER | search assignmentGroup="WG1555" AND isBreached="t" AND status="Closed" |stats count

index=itsm sourcetype=sm9_incident | dedup NUMBER | search assignmentGroup="WG1555" AND status="Closed" | stats count

Tags (2)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi bvenom28,

try something like this:

index=itsm sourcetype=sm9_incident assignmentGroup="WG1555" | dedup NUMBER | eventstats count(eval(isBreached="t" AND status="Closed")) as isBreachedCount count(eval(status="Closed")) as ClosedCount | eval myPrec=isBreachedCount*100/ClosedCount | table myPrec

cheers, MuS

View solution in original post

marcoscala
Builder

bvenom28,

your searches where really not well formed:

index=itsm sourcetype=sm9_incident | dedup NUMBER | search assignmentGroup="WG1555" AND isBreached="t" AND status="Closed" |stats count

The search terms should always be places at the beginning of the search, unless you really need to filter out results based on same valued calculated in a stats or eval statement.

As correctly MuS wrote, the assignmentGroup="WG1555" condition has been placed right at the beginning, and he wisely used the "count(eval('condition')) trick to summarize values of events matching a certain condition.

marco

MuS
SplunkTrust
SplunkTrust

Hi bvenom28,

try something like this:

index=itsm sourcetype=sm9_incident assignmentGroup="WG1555" | dedup NUMBER | eventstats count(eval(isBreached="t" AND status="Closed")) as isBreachedCount count(eval(status="Closed")) as ClosedCount | eval myPrec=isBreachedCount*100/ClosedCount | table myPrec

cheers, MuS

piebob
Splunk Employee
Splunk Employee

bvenom28, i recommend you check out the search and reporting class offered by the Splunk EDU team, it's a good way to get started!

bvenom28
Engager

Wow that worked perfect. I have alot to learn. Thanks!!!!

Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...