Splunk Search

Percentage of two calculated search values

pir8radio
Path Finder

don't hate me @to4kawa But can you help me one last time! Ive been stuck for a few hours trying to figure out how to do this, my splunk forum searches are getting me close, but I'm not sure how to go about it... I know the below search is incorrect, but i need to come up with the "avg_kWhU" value and and the "avg_kWhP" value in one search, and then find the percentage difference between kwh used and kwh produced. for example if kWhP was 50 and kWhU was 50 Percent_powered would be 100%

i think i cant have two bins grouping by _time? I have tried many things, and seem to be stuck 😞

| where 'usage_info.d_w'>=0 or 'usage_info.solar_w'>=0 
| bin _time span=1h

  | stats count as samplesU sum(usage_info.d_w) as watt_sumU by _time
  | eval kW_SumU=watt_sumU/1000
  | eval avg_kWhU=kW_SumU/samplesU

  | stats count as samplesP sum(usage_info.solar_w) as watt_sumP by _time
  | eval kW_SumP=watt_sumP/1000
  | eval avg_kWhP=kW_SumP/samplesP

| eval percent_powered=((avg_kWhP/avg_kWhU)100) 
| table percent_powered
Labels (2)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion

try multireport

| where 'usage_info.d_w'>=0 or 'usage_info.solar_w'>=0 
| bin _time span=1h 
| multireport 
    [| stats count as samplesU sum(usage_info.d_w) as watt_sumU by _time 
    | eval kW_SumU=watt_sumU/1000 
    | eval avg_kWhU=kW_SumU/samplesU ] 
    [| stats count as samplesP sum(usage_info.solar_w) as watt_sumP by _time 
    | eval kW_SumP=watt_sumP/1000 
    | eval avg_kWhP=kW_SumP/samplesP ] 
| selfjoin _time
| eval percent_powered=round((avg_kWhP/avg_kWhU)*100),2)
| table percent_powered

multireport has no reference.

reference:
https://www.google.com/search?q=multireport+splunk

don't hate me @to4kawa

No, I don't think so.

View solution in original post

0 Karma

to4kawa
Ultra Champion

try multireport

| where 'usage_info.d_w'>=0 or 'usage_info.solar_w'>=0 
| bin _time span=1h 
| multireport 
    [| stats count as samplesU sum(usage_info.d_w) as watt_sumU by _time 
    | eval kW_SumU=watt_sumU/1000 
    | eval avg_kWhU=kW_SumU/samplesU ] 
    [| stats count as samplesP sum(usage_info.solar_w) as watt_sumP by _time 
    | eval kW_SumP=watt_sumP/1000 
    | eval avg_kWhP=kW_SumP/samplesP ] 
| selfjoin _time
| eval percent_powered=round((avg_kWhP/avg_kWhU)*100),2)
| table percent_powered

multireport has no reference.

reference:
https://www.google.com/search?q=multireport+splunk

don't hate me @to4kawa

No, I don't think so.

0 Karma

pir8radio
Path Finder

I didn't even know this was possible. thanks!

0 Karma
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...