Percentage between two searches (timecharts)

[vonAnden]

Hi

I have a problem I hope someone can help me with..
I have two searches:
one timechart for totalvolume per day:

Type= trade-confirmed |
rename Properties.DailyStats{}.ConsumptionDay AS ConsumptionDay, Properties.DailyStats{}.TotalAmount AS TotalAmount |
eval x=mvzip(TotalAmount,ConsumptionDay)| mvexpand x | eval x = split(x,",") | eval TotalAmount=mvindex(x,0) | eval ConsumptionDay =mvindex(x,1) |
eval _time=strptime(ConsumptionDay, "%Y-%m-%dT%H:%M:%S.%N") | timechart sum(TotalAmount) as Total span=1d | fillnull value=0 Total

and one timechart for bought volume per day:

Type=trade-bought | timechart sum(Properties.HourlyStats{}.boughtVolume) as Bought span=1d

Now I want to find out what the bought percentage is of the total volume for each day, I have tried something like this:

Type=trade-bought  |
  rename Properties.HourlyStats{}.boughtVolume AS Bought |
  eval procentage= 100 * Bought / [ search Type= trade-confirmed |
  rename Properties.DailyStats{}.ConsumptionDay AS ConsumptionDay, Properties.DailyStats{}.TotalAmount AS TotalAmount |
  eval x=mvzip(TotalAmount,ConsumptionDay)| mvexpand x |
  eval x = split(x,",") | eval TotalAmount=mvindex(x,0) |
  eval ConsumptionDay =mvindex(x,1) |
  eval _time=strptime(ConsumptionDay, "%Y-%m-%dT%H:%M:%S.%N") |
  timechart sum(TotalAmount) as Total span=1d | fillnull value=0 Total |
  rename Total as search ]  |
  timechart sum(procentage) as Procentagee span=1d

But i doesn't work.. so hope you guys can help 🙂

[MuS]

Hi vonAnden,

take a look at this answer here http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-joi... to get an idea how it could be done.

Based on your two searches, I would start off by using the two types and eval all needed fields and stats them.

Type=trade-bought OR Type=trade-confirmed | ....

Hope this helps ...

cheers, MuS

btw: a subsearch expands to a list of result=foo OR result=boo OR result.... and looking at your used search this makes no sense, because this will be used in an eval....