Splunk Search

Using count as a field for calculation

DerekKing
Path Finder

Hi,

I have a field "scanned_hosts" that has a value (say 20), and I also have a number of events, which to my understanding is the built in field count.

What I would like to do is create a radial gauge that is a percentage calculation of the two fields. so I want to do something like

index=blah source=blah | eval mypercentage = 100*(count/scanned_hosts) | gauge mypercentage

I can't use my command as it appears I dont have count available to use in the way that I want to use it, and stats count AS mycount doesnt give me what i'm looking for either.

Any Help would be appreciated

Thanks
Derek.

Tags (1)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

count is only generated during a statistical command.

Try this:

index=blah source=blah | stats count max(scanned_hosts) as scanned_hosts | eval mypercentage = 100 * ( count / scanned_hosts ) | gauge mypercentage

View solution in original post

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

count is only generated during a statistical command.

Try this:

index=blah source=blah | stats count max(scanned_hosts) as scanned_hosts | eval mypercentage = 100 * ( count / scanned_hosts ) | gauge mypercentage
0 Karma

DerekKing
Path Finder

Thanks very much. I think you have just cleared up a long time misunderstanding. "count is only generated during a statistical command".

The above works, and is exactly what I was looking for - thanks.

Derek.

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...