Splunk Search

How to stats ratio based on two fields

cheriemilk
Path Finder

Hi team,

I have a below sample raw events in splunk.

2020-11-30 19:15:26,726 ratingEnabled="[performance]"

2020-11-30 15:59:13,827 ratingEnabled="[objective,competency]" ratingEnabledGuideline="[objectiveGuideline]"

2020-11-30 05:34:40,986 ratingEnabled="[performance]" ratingEnabledGuideline="[performanceGuideline]"

stats requirement:

I want to get a ratio that enabled guideline per each rating. For example: analyze above sample events,

1. there are 3 ratings enabled(refer to ratingEnabled field): performance, objective and competency

2. there're 2 ratings enabled guideline(refer to ratingEnabledGuideline field): objective and performance

So the expected result I want splunk to return is:

 

ratingEnabledcountcount - enabled Guidelineratio - enabled guideline
performance2150%
objective11100%
competency100%

 

How to stats the ratio in this scenario?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=0 field=ratingEnabled "(?<ratingEnabled>[^\[,\]]+)"
| mvexpand ratingEnabled
| rex field=ratingEnabledGuideline "(?<guideline>[^\[]+)Guideline"
| eval guided=if(ratingEnabled=guideline,1,0)
| stats count sum(guided) as guided by ratingEnabled
| eval ratio=guided*100/count

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=0 field=ratingEnabled "(?<ratingEnabled>[^\[,\]]+)"
| mvexpand ratingEnabled
| rex field=ratingEnabledGuideline "(?<guideline>[^\[]+)Guideline"
| eval guided=if(ratingEnabled=guideline,1,0)
| stats count sum(guided) as guided by ratingEnabled
| eval ratio=guided*100/count
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...