Splunk Search

Joining two queries and getting a percentage

paul_1994
Path Finder

I have two queries that I am running and I want to take the results / Count of these queries and divide them. I have seen several variances but I am still having issues trying to get my search correct.

Here is an example of my queries:

index=norlogs sourcetype="devicelog" category="NSException, on wi-fi:"

index=norlogs sourcetype="devicelog" category="FinishLaunching"

I would like to divide the first query by the last query and display a percentage. What would be the best way to accomplish this.

This is working but I am not getting percentages

index=norlogs sourcetype="devicelog" category="NSException"| stats count as TotalA | appendcols [search index=norlogs sourcetype="devicelog" category="FinishLaunching" | stats count as TotalB] | eval Total=TotalB/TotalA

Tags (1)
1 Solution

emiller42
Motivator

Try something like this:

index="norlogs" sourcetype="devicelog" category="NSException" OR category="FinishLaunching" | eval A=if(category=="NSException", 1, 0) | eval B=if(category=="FinishLaunching", 1, 0) | stats sum(A) as TotalA sum(B) as TotalB | eval pct=TotalB/TotalA

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Another working solution --

index=norlogs sourcetype=devicelog category="NSException" OR category="FinishLaunching" 
| stats count by sourcetype,category
| xyseries sourcetype, category, count
| eval pct=NSException / FinishLaunching

paul_1994
Path Finder

For some reason I could not get this working for me..

Are these the categories? eval pct=NSException / FinishLaunching

Also if my categories are more like this " NSexception 222: helpme" will the above still work?

Thanks!

0 Karma

emiller42
Motivator

Try something like this:

index="norlogs" sourcetype="devicelog" category="NSException" OR category="FinishLaunching" | eval A=if(category=="NSException", 1, 0) | eval B=if(category=="FinishLaunching", 1, 0) | stats sum(A) as TotalA sum(B) as TotalB | eval pct=TotalB/TotalA

paul_1994
Path Finder

Yay.. thanks I was able to use this solution.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

(yay IRC!)

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...