Splunk Search

Percentage of two calculated search values

pir8radio
Path Finder

don't hate me @to4kawa But can you help me one last time! Ive been stuck for a few hours trying to figure out how to do this, my splunk forum searches are getting me close, but I'm not sure how to go about it... I know the below search is incorrect, but i need to come up with the "avg_kWhU" value and and the "avg_kWhP" value in one search, and then find the percentage difference between kwh used and kwh produced. for example if kWhP was 50 and kWhU was 50 Percent_powered would be 100%

i think i cant have two bins grouping by _time? I have tried many things, and seem to be stuck 😞

| where 'usage_info.d_w'>=0 or 'usage_info.solar_w'>=0 
| bin _time span=1h

  | stats count as samplesU sum(usage_info.d_w) as watt_sumU by _time
  | eval kW_SumU=watt_sumU/1000
  | eval avg_kWhU=kW_SumU/samplesU

  | stats count as samplesP sum(usage_info.solar_w) as watt_sumP by _time
  | eval kW_SumP=watt_sumP/1000
  | eval avg_kWhP=kW_SumP/samplesP

| eval percent_powered=((avg_kWhP/avg_kWhU)100) 
| table percent_powered
Labels (2)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion

try multireport

| where 'usage_info.d_w'>=0 or 'usage_info.solar_w'>=0 
| bin _time span=1h 
| multireport 
    [| stats count as samplesU sum(usage_info.d_w) as watt_sumU by _time 
    | eval kW_SumU=watt_sumU/1000 
    | eval avg_kWhU=kW_SumU/samplesU ] 
    [| stats count as samplesP sum(usage_info.solar_w) as watt_sumP by _time 
    | eval kW_SumP=watt_sumP/1000 
    | eval avg_kWhP=kW_SumP/samplesP ] 
| selfjoin _time
| eval percent_powered=round((avg_kWhP/avg_kWhU)*100),2)
| table percent_powered

multireport has no reference.

reference:
https://www.google.com/search?q=multireport+splunk

don't hate me @to4kawa

No, I don't think so.

View solution in original post

0 Karma

to4kawa
Ultra Champion

try multireport

| where 'usage_info.d_w'>=0 or 'usage_info.solar_w'>=0 
| bin _time span=1h 
| multireport 
    [| stats count as samplesU sum(usage_info.d_w) as watt_sumU by _time 
    | eval kW_SumU=watt_sumU/1000 
    | eval avg_kWhU=kW_SumU/samplesU ] 
    [| stats count as samplesP sum(usage_info.solar_w) as watt_sumP by _time 
    | eval kW_SumP=watt_sumP/1000 
    | eval avg_kWhP=kW_SumP/samplesP ] 
| selfjoin _time
| eval percent_powered=round((avg_kWhP/avg_kWhU)*100),2)
| table percent_powered

multireport has no reference.

reference:
https://www.google.com/search?q=multireport+splunk

don't hate me @to4kawa

No, I don't think so.

0 Karma

pir8radio
Path Finder

I didn't even know this was possible. thanks!

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...