Splunk Search

"Field1" can have one value as either yes or no. Calculate count for yes as count1 and count for no

VS0909
Communicator

"Field1" can have one value as either 'yes' or 'no'. I want to calculate count for 'yes' as count1 and count for 'no'  as count2. Then calculate the ratio of count1 and count2.

Any pointers please

Labels (6)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
...
| eval count1=if(Field1="yes",1,0)
| eval count2=if(Field2="yes",1,0)
| stats sum(count1) as count1, sum(count2) as count2
| eval ratio=count1/count2
| fields ratio

View solution in original post

VS0909
Communicator

@ITWhisperer  Thanks! Appreciate it

0 Karma

VS0909
Communicator

@ITWhisperer  Thanks for the reply.

I am trying to do the above for two fields - field1 and field2 in a single spunk query, but somehow facing issues. 

"Field1" can have one value as either 'yes' or 'no'. "Field2" can have one value as either 'yes' or 'no'.

I want to calculate count for 'yes' as count1 for field1

and count for 'yes'  as count2 for field2. Then calculate the ratio of count1 and count2.

Any pointers please

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
...
| eval count1=if(Field1="yes",1,0)
| eval count2=if(Field2="yes",1,0)
| stats sum(count1) as count1, sum(count2) as count2
| eval ratio=count1/count2
| fields ratio

ITWhisperer
SplunkTrust
SplunkTrust
| stats count by Field1
| eval count1=if(Field1="yes",count,NULL()) 
| eval count2=if(Field1="no",count,NULL()) 
| fields count1, count2 
| stats values(*) as * 
| eval ratio=count1/count2
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...