Splunk Search

## How to perfom math calculations

Engager

I am trying to figure out how to take two searches and divide their results to create a dial chart showing the percentage of breached records.

index=itsm sourcetype=sm9_incident | dedup NUMBER | search assignmentGroup="WG1555" AND isBreached="t" AND status="Closed" |stats count

index=itsm sourcetype=sm9_incident | dedup NUMBER | search assignmentGroup="WG1555" AND status="Closed" | stats count

Tags (2)
1 Solution
SplunkTrust

Hi bvenom28,

try something like this:

``````index=itsm sourcetype=sm9_incident assignmentGroup="WG1555" | dedup NUMBER | eventstats count(eval(isBreached="t" AND status="Closed")) as isBreachedCount count(eval(status="Closed")) as ClosedCount | eval myPrec=isBreachedCount*100/ClosedCount | table myPrec
``````

cheers, MuS

Builder

bvenom28,

your searches where really not well formed:

index=itsm sourcetype=sm9_incident | dedup NUMBER | search assignmentGroup="WG1555" AND isBreached="t" AND status="Closed" |stats count

The search terms should always be places at the beginning of the search, unless you really need to filter out results based on same valued calculated in a stats or eval statement.

As correctly MuS wrote, the assignmentGroup="WG1555" condition has been placed right at the beginning, and he wisely used the "count(eval('condition')) trick to summarize values of events matching a certain condition.

marco

SplunkTrust

Hi bvenom28,

try something like this:

``````index=itsm sourcetype=sm9_incident assignmentGroup="WG1555" | dedup NUMBER | eventstats count(eval(isBreached="t" AND status="Closed")) as isBreachedCount count(eval(status="Closed")) as ClosedCount | eval myPrec=isBreachedCount*100/ClosedCount | table myPrec
``````

cheers, MuS

Splunk Employee

bvenom28, i recommend you check out the search and reporting class offered by the Splunk EDU team, it's a good way to get started!

Engager

Wow that worked perfect. I have alot to learn. Thanks!!!!

Get Updates on the Splunk Community!

#### Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

#### Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

#### Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...