Splunk Search

Joining two queries and getting a percentage

paul_1994
Path Finder

I have two queries that I am running and I want to take the results / Count of these queries and divide them. I have seen several variances but I am still having issues trying to get my search correct.

Here is an example of my queries:

index=norlogs sourcetype="devicelog" category="NSException, on wi-fi:"

index=norlogs sourcetype="devicelog" category="FinishLaunching"

I would like to divide the first query by the last query and display a percentage. What would be the best way to accomplish this.

This is working but I am not getting percentages

index=norlogs sourcetype="devicelog" category="NSException"| stats count as TotalA | appendcols [search index=norlogs sourcetype="devicelog" category="FinishLaunching" | stats count as TotalB] | eval Total=TotalB/TotalA

Tags (1)
1 Solution

emiller42
Motivator

Try something like this:

index="norlogs" sourcetype="devicelog" category="NSException" OR category="FinishLaunching" | eval A=if(category=="NSException", 1, 0) | eval B=if(category=="FinishLaunching", 1, 0) | stats sum(A) as TotalA sum(B) as TotalB | eval pct=TotalB/TotalA

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Another working solution --

index=norlogs sourcetype=devicelog category="NSException" OR category="FinishLaunching" 
| stats count by sourcetype,category
| xyseries sourcetype, category, count
| eval pct=NSException / FinishLaunching

paul_1994
Path Finder

For some reason I could not get this working for me..

Are these the categories? eval pct=NSException / FinishLaunching

Also if my categories are more like this " NSexception 222: helpme" will the above still work?

Thanks!

0 Karma

emiller42
Motivator

Try something like this:

index="norlogs" sourcetype="devicelog" category="NSException" OR category="FinishLaunching" | eval A=if(category=="NSException", 1, 0) | eval B=if(category=="FinishLaunching", 1, 0) | stats sum(A) as TotalA sum(B) as TotalB | eval pct=TotalB/TotalA

paul_1994
Path Finder

Yay.. thanks I was able to use this solution.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

(yay IRC!)

Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...