Splunk Search

Joining two queries and getting a percentage

paul_1994
Path Finder

I have two queries that I am running and I want to take the results / Count of these queries and divide them. I have seen several variances but I am still having issues trying to get my search correct.

Here is an example of my queries:

index=norlogs sourcetype="devicelog" category="NSException, on wi-fi:"

index=norlogs sourcetype="devicelog" category="FinishLaunching"

I would like to divide the first query by the last query and display a percentage. What would be the best way to accomplish this.

This is working but I am not getting percentages

index=norlogs sourcetype="devicelog" category="NSException"| stats count as TotalA | appendcols [search index=norlogs sourcetype="devicelog" category="FinishLaunching" | stats count as TotalB] | eval Total=TotalB/TotalA

Tags (1)
1 Solution

emiller42
Motivator

Try something like this:

index="norlogs" sourcetype="devicelog" category="NSException" OR category="FinishLaunching" | eval A=if(category=="NSException", 1, 0) | eval B=if(category=="FinishLaunching", 1, 0) | stats sum(A) as TotalA sum(B) as TotalB | eval pct=TotalB/TotalA

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Another working solution --

index=norlogs sourcetype=devicelog category="NSException" OR category="FinishLaunching" 
| stats count by sourcetype,category
| xyseries sourcetype, category, count
| eval pct=NSException / FinishLaunching

paul_1994
Path Finder

For some reason I could not get this working for me..

Are these the categories? eval pct=NSException / FinishLaunching

Also if my categories are more like this " NSexception 222: helpme" will the above still work?

Thanks!

0 Karma

emiller42
Motivator

Try something like this:

index="norlogs" sourcetype="devicelog" category="NSException" OR category="FinishLaunching" | eval A=if(category=="NSException", 1, 0) | eval B=if(category=="FinishLaunching", 1, 0) | stats sum(A) as TotalA sum(B) as TotalB | eval pct=TotalB/TotalA

paul_1994
Path Finder

Yay.. thanks I was able to use this solution.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

(yay IRC!)

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...