Splunk Search

Mathematic manipulation on 2 separate seraches

ramic
Engager

I want to perform mathematic manipulations on 2 unrelated search results.

i.e. I want to take a result like:
source="xxxx" sourcetype="xxx" eventType="xxx" clientVersion="x.x.x" | stats count as A

and divide it by a completely new search result:
source="yyyy" sourcetype="yyy" eventType="yyy" clientVersion="y.y.y" | stats count as B

A/B

Tags (2)
0 Karma
1 Solution

gfuente
Motivator

Maybe it will perform better with just one search, like:

(source="xxxx" sourcetype="xxx" eventType="xxx" clientVersion="x.x.x") OR (source="yyyy" sourcetype="yyy" eventType="yyy" clientVersion="y.y.y") | stats count(eval(if(clientVersion="x.x.x",1,null))) as A, count(eval(if(clientVersion="y.y.y",1,null))) as B | eval Results = A/B

Regards

View solution in original post

0 Karma

gfuente
Motivator

Maybe it will perform better with just one search, like:

(source="xxxx" sourcetype="xxx" eventType="xxx" clientVersion="x.x.x") OR (source="yyyy" sourcetype="yyy" eventType="yyy" clientVersion="y.y.y") | stats count(eval(if(clientVersion="x.x.x",1,null))) as A, count(eval(if(clientVersion="y.y.y",1,null))) as B | eval Results = A/B

Regards

0 Karma

ramic
Engager

Thank you both, this works.
Still haven't figured how to manipulate multisearch results, used single search instead.

gfuente
Motivator

You are right

0 Karma

ddarmand
Communicator

It works but parenthesis are wrong

(source="xxxx" sourcetype="xxx" eventType="xxx" clientVersion="x.x.x") OR (source="yyyy" sourcetype="yyy" eventType="yyy" clientVersion="y.y.y") | stats count(eval(if(clientVersion="x.x.x",1,null))) as A, count(eval(if(clientVersion="y.y.y",1,null))) as B | eval Results = A/B

ddarmand
Communicator

You can use multisearch for this

| multisearch [search index=a sourcetype="a" | eval type="A"] [search index=b sourcetype=b | eval type="B"]

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...