Splunk Search

Need help with eval

Dsrao12345
New Member

my search query :

index=index1"PrepareResponseTime= " 
| rex "PreResponseTime= (?[0-9]*) ms"  
| where PrepareResponseTime > 1000 
| eval PrepareResponseTime= "count >1000"  
| stats count by index,PrepareOrderResponseTime 
| append [search index=index2 "PrepareResponseTime= " 
| rex "PrepareResponseTime= (?[0-9]*) ms"  
| where PrepareResponseTime < 1000 | eval PrepareResponseTime= "count <1000"  

statistics results:

indexname PrepareResponseTime count
========= =================== =====
index1 count >1000 1486
index2 count <1000 6639

I would like to using eval calculate percentage like below:

(1486 * 100) / (1486 + 6639) = %

148600/8125 = 18.289 (round)

After using calculations results to be like :

round 18.29%

Tags (2)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@Dsrao12345,

Add this to your search

| eventstats sum(count) as total
| eval perc=round((count/total)*100,2)

And your original search probably could be modified as

 (index=index1  OR  index=index2) "PrepareResponseTime= "  
 |rex "PreResponseTime= (?[0-9]) ms"
 |eval ResponseTime=if(PrepareResponseTime <1000,"count <1000","count >1000" )
 |stats count by index,ResponseTime
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...