Splunk Search

compute the ratio of some specific fields in total event

hjwang
Contributor

Hello,i would like to compute the ratio of some specific fields in total event, for example, in IPS attack event log, i wanna get known with the ratio of scr_ip coming from the specific country in total attack event, it seems straightforward, but i don't know how to use search command.(that is to say the number of events by using src=xxx or src=xxx..., divided by the number of events non-using such condiction), Thanks!!

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee
... | stats count(src=="xxx") as xxx_count, count as total_count | eval ratio = xxx_count/total_count

View solution in original post

suminty
New Member

You would need to add eval with stats some thing like

| stats count(eval(rslt=="found")) as cache_hit, count as total_count | eval ratio=cache_hit/total_count
,we will need add eval in stats something like:


| stats count(eval(rslt=="found")) as cache_hit, count as total_count | eval ratio=cache_hit/total_count

0 Karma

gkanapathy
Splunk Employee
Splunk Employee
... | stats count(src=="xxx") as xxx_count, count as total_count | eval ratio = xxx_count/total_count

hjwang
Contributor

thanks, i try it, but the syntax stats should be count(eval(src="xxx")) as xxx_count

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>