Splunk Search

setting event occurrences in relation with each other

zaphod1984
Path Finder

Hi,
I need to set the occurences of certain log events in relation with each other.

Consider the following log entries:
event=foo
event=foo
event=foo
event=bar
event=bar

As an end result I now want to get the relation of the values 3 (number of foo events) and 2 (number of bar events), e.g. 0.66666

My current approach looks like this:
index=fooIndex (event=foo OR event=bar) | timechart span=1d count by event | eval perc = (bar/foo)*100 | table perc

But this feels a little clunky since the time dimension is not actually relevant and the timechart command is only used to put the results together into one row.
What would be the better approach to this?

Thanks in advance!

Tags (2)
0 Karma
1 Solution

zaphod1984
Path Finder

for completenes this is the solution i came up with.
(inspired by: http://docs.splunk.com/Documentation/Storm/Storm/User/Moresearchexamples)

index=fooIndex | stats count(eval(event="foo")) as fooCount, count(eval(event="bar")) as barCount | eval perc = (barCount/fooCount)*100 | table fooCount, barCount, perc

View solution in original post

0 Karma

zaphod1984
Path Finder

for completenes this is the solution i came up with.
(inspired by: http://docs.splunk.com/Documentation/Storm/Storm/User/Moresearchexamples)

index=fooIndex | stats count(eval(event="foo")) as fooCount, count(eval(event="bar")) as barCount | eval perc = (barCount/fooCount)*100 | table fooCount, barCount, perc

0 Karma

tom_frotscher
Builder

Hi!

I think your approach isn't bad.
Is the time dimension really completely irrelevant?. At least your results are returned in one day spans.
I think you could also use a combination of the stats and bucket command.

Greetings

Tom

0 Karma

zaphod1984
Path Finder

thanks for your answer, i came up with another solution that i like a bit better than the timechart one (see below).

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...