Splunk Search

multisearch

zakura
Explorer

Hi , I have 2 queries :

index="bar_*" sourcetype =foo crm="ser"
| dedup uid
| stats count as TotalCount

and 

index="bar_*" sourcetype =foo crm="ser" jet="fas"
| dedup uid
| stats count as TotalFalseCount

I need both of these queries merged and then take "TotalCount" and "TotalFalseCount" and get value from these as : ActualPercent= (TotalFalseCount/TotalCount)*100.

I created one query as below:

index="bar_*" sourcetype =foo crm="ser"
| dedup uid
| stats count as TotalCount by zerocode SubType
| appendcols
                [searchindex="bar_*" sourcetype =foo crm="ser" jet="fas"
                     | dedup uid
                          | stats count as TotalFalseCount by zerocode SubType]
 | eval Percent=(TotalFalseCount/TotalCount)*100
   | stats count by zerocode SubType Percent

 

but the value of "Percent" is completely wrong, can anybody help to know how can I get proper value of "Percent" in above case ?

Labels (1)
0 Karma
1 Solution

zakura
Explorer

With Minor modification it exactly helped to do what I was looking for :

 

index="bar_*" sourcetype =foo crm="ser"

| dedup uid

| stats count as TotalCount by zerocode SubType

| append

  [search index="bar_*" sourcetype =foo crm="ser" jet="fas"

  | dedup uid

  | stats count as TotalFalseCount by zerocode SubType]

| stats values as * by zerocode SubType

| eval Percent=(TotalFalseCount/TotalCount)*100

| eval Percentage = round('Percent',2)

| xyseries SubType zerocode Percentage

| fillnull value="NA"

View solution in original post

0 Karma

zakura
Explorer

@richgalloway  -- You are awesome ! Thanks a lot !

0 Karma

richgalloway
SplunkTrust
SplunkTrust

One problem with the appendcols command is it depends on the order of results being identical in both queries, which is not likely.

Use the append command instead then combine the two set of results using stats.

index="bar_*" sourcetype =foo crm="ser"
| dedup uid
| stats count as TotalCount by zerocode SubType
| append
  [search index="bar_*" sourcetype =foo crm="ser" jet="fas"
  | dedup uid
  | stats count as TotalFalseCount by zerocode SubType]
| stats values(*) as * by zerocode SubType
| fillnull value=0 TotalFalseCount
| eval Percent=(TotalFalseCount/TotalCount)*100
| stats count by zerocode SubType Percent

 

---
If this reply helps you, Karma would be appreciated.

zakura
Explorer

With Minor modification it exactly helped to do what I was looking for :

 

index="bar_*" sourcetype =foo crm="ser"

| dedup uid

| stats count as TotalCount by zerocode SubType

| append

  [search index="bar_*" sourcetype =foo crm="ser" jet="fas"

  | dedup uid

  | stats count as TotalFalseCount by zerocode SubType]

| stats values as * by zerocode SubType

| eval Percent=(TotalFalseCount/TotalCount)*100

| eval Percentage = round('Percent',2)

| xyseries SubType zerocode Percentage

| fillnull value="NA"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...