I am very new to Splunk (as in this is my 3rd day using it) and am having some issues understanding what I am doing wrong.
specific.server
| stats dc(userID) as totalUsers
| append [search specific.server AND "text" | stats count(field) as variableA]
| eval variableB = exact(variableA/totalUsers)
| stats sum(totalUsers), sum(variableA), sum(variableB)
Now when this runs sum(totalUsers) and sum(variableA) shows up correctly however sum(variableB) always shows up as a blank field. I have tried many different ways and none of them have worked.
Now I will explain the way I am understanding what I wrote.
Please explain to me what I am understanding incorrectly and if at all possible how to achieve what I am trying to do or at least point me in the right direction.
Thanks
First, you don't want append
, you want appendcols
. When you use append
, you will end up with multiple events - you want all these results in a single event.
Second, you need to time-constrain your inner search, else it runs over all time. I have done that by using addinfo
to collect the time parameters of the outer search, and then apply them to the inner search.
Finally, I don't think you need the final stats command, either.
specific.server
| stats dc(userID) as totalUsers
| appendcols [ search specific.server AND "text"
addinfo | where _time >= info_min_time AND _time <=info_max_time
| stats count(field) as variableA ]
| eval variableB = exact(variableA/totalUsers)