Splunk Search

Mathematic manipulation on 2 separate seraches

ramic
Engager

I want to perform mathematic manipulations on 2 unrelated search results.

i.e. I want to take a result like:
source="xxxx" sourcetype="xxx" eventType="xxx" clientVersion="x.x.x" | stats count as A

and divide it by a completely new search result:
source="yyyy" sourcetype="yyy" eventType="yyy" clientVersion="y.y.y" | stats count as B

A/B

Tags (2)
0 Karma
1 Solution

gfuente
Motivator

Maybe it will perform better with just one search, like:

(source="xxxx" sourcetype="xxx" eventType="xxx" clientVersion="x.x.x") OR (source="yyyy" sourcetype="yyy" eventType="yyy" clientVersion="y.y.y") | stats count(eval(if(clientVersion="x.x.x",1,null))) as A, count(eval(if(clientVersion="y.y.y",1,null))) as B | eval Results = A/B

Regards

View solution in original post

0 Karma

gfuente
Motivator

Maybe it will perform better with just one search, like:

(source="xxxx" sourcetype="xxx" eventType="xxx" clientVersion="x.x.x") OR (source="yyyy" sourcetype="yyy" eventType="yyy" clientVersion="y.y.y") | stats count(eval(if(clientVersion="x.x.x",1,null))) as A, count(eval(if(clientVersion="y.y.y",1,null))) as B | eval Results = A/B

Regards

0 Karma

ramic
Engager

Thank you both, this works.
Still haven't figured how to manipulate multisearch results, used single search instead.

gfuente
Motivator

You are right

0 Karma

ddarmand
Communicator

It works but parenthesis are wrong

(source="xxxx" sourcetype="xxx" eventType="xxx" clientVersion="x.x.x") OR (source="yyyy" sourcetype="yyy" eventType="yyy" clientVersion="y.y.y") | stats count(eval(if(clientVersion="x.x.x",1,null))) as A, count(eval(if(clientVersion="y.y.y",1,null))) as B | eval Results = A/B

ddarmand
Communicator

You can use multisearch for this

| multisearch [search index=a sourcetype="a" | eval type="A"] [search index=b sourcetype=b | eval type="B"]

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...