Splunk Search

Perform calculation based on 2 stats count result

krusovice
Path Finder

Hello,

I've a requirement to perform the following calculation in percentage.

First query is as below and single value result is 50

    index=* 
    | rex field=_raw "Product ABC.*client\=(?<client>[\w+]+)" 
    | stats count(client) as Count

Then I've another query and single value result is 10:

index=* 
| rex field=_raw "Broken Product.*productid\=(?<productid>[\w+]+)" 
| stats count(productid)

I need to perform the calculation based on the result of above 2 queries. The calculation formula should be 10/50 = 20%. How can I achieve it to come out with 20% as the output of the calculation in Splunk?

Thanks.

Tags (1)
0 Karma
1 Solution

493669
Super Champion

try this:

 index=*|rex field=_raw "Product ABC.*client\=(?<client>[\w+]+)" 
| rex field=_raw "Broken Product.*productid\=(?<productid>[\w+]+)" 
| stats count(client) as clientcount , count(productid) as productcount
|eval percentage=((productcount/clientcount)*100)."%"

View solution in original post

0 Karma

493669
Super Champion

try this:

 index=*|rex field=_raw "Product ABC.*client\=(?<client>[\w+]+)" 
| rex field=_raw "Broken Product.*productid\=(?<productid>[\w+]+)" 
| stats count(client) as clientcount , count(productid) as productcount
|eval percentage=((productcount/clientcount)*100)."%"
0 Karma

krusovice
Path Finder

Hi @493669,

It's work! Thank you. Can you update as answer so that I can accept it officially?

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...