Splunk Search

Perform calculation based on 2 stats count result

krusovice
Path Finder

Hello,

I've a requirement to perform the following calculation in percentage.

First query is as below and single value result is 50

    index=* 
    | rex field=_raw "Product ABC.*client\=(?<client>[\w+]+)" 
    | stats count(client) as Count

Then I've another query and single value result is 10:

index=* 
| rex field=_raw "Broken Product.*productid\=(?<productid>[\w+]+)" 
| stats count(productid)

I need to perform the calculation based on the result of above 2 queries. The calculation formula should be 10/50 = 20%. How can I achieve it to come out with 20% as the output of the calculation in Splunk?

Thanks.

Tags (1)
0 Karma
1 Solution

493669
Super Champion

try this:

 index=*|rex field=_raw "Product ABC.*client\=(?<client>[\w+]+)" 
| rex field=_raw "Broken Product.*productid\=(?<productid>[\w+]+)" 
| stats count(client) as clientcount , count(productid) as productcount
|eval percentage=((productcount/clientcount)*100)."%"

View solution in original post

0 Karma

493669
Super Champion

try this:

 index=*|rex field=_raw "Product ABC.*client\=(?<client>[\w+]+)" 
| rex field=_raw "Broken Product.*productid\=(?<productid>[\w+]+)" 
| stats count(client) as clientcount , count(productid) as productcount
|eval percentage=((productcount/clientcount)*100)."%"
0 Karma

krusovice
Path Finder

Hi @493669,

It's work! Thank you. Can you update as answer so that I can accept it officially?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...