Splunk Search
Highlighted

Is there a way to do calculation on streamstats values?

New Member

Hi folks, newbie here, trying to use Splunk to do some stuff...

I have a search that ends like below:

| table DaysSinceLastAccess Good IdealbutUnlikely NotGood Actual
| sort by num(DaysSinceLastAccess)
| streamstats sum(Actual) as ActualCumulative

So has the stats as:

alt text

I would like to calculate the total on column Actual, via addcoltotals? then divide each row by this total.

How can I achieve this?

0 Karma
Highlighted

Re: Is there a way to do calculation on streamstats values?

Influencer

Append below to your search

 | eventstats sum(Actual) as Total | eval yourNewField = ActualCumulative/Total 

View solution in original post

Highlighted

Re: Is there a way to do calculation on streamstats values?

New Member

thanks! exactly what i wanted.

0 Karma