×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Megz
Explorer
Member since: ‎05-17-2022
‎05-19-2022
Community Statistics
Posts 3
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎05-17-2022
Activity Feed
View All

Re: How to create eval to divide counts by auditTy...

by in Splunk Search
‎05-18-2022 04:52 AM
‎05-18-2022 04:52 AM
Hi @ITWhisperer  This works for doing the counting! Thank you so much The issue now is calculating the % as there are null values in the table. I tried adding in a where clause to the end specifying where Starts>0 and Completions>0 but this doesn't return any results. p.s. I know the completions are more than the starts just now as this is in a testing environment.     ... View more

Re: How to create eval to divide counts by auditTy...

by in Splunk Search
‎05-18-2022 03:50 AM
‎05-18-2022 03:50 AM
Hi Somesoni   I've plugged that in but I get the following error (subbed audit type and session field)   Error in 'stats' command: The eval expression for dynamic field 'eval(if(auditType=TYPE1,SESSIONS,null()))' is invalid. Error='Typechecking failed. '-' only takes numbers.'   I tried replacing the null() with 0 instead to see if that kicked it in but no luck 😞   Thanks for replying 🙂    ... View more

How to create eval to divide counts by auditType?

by in Splunk Search
‎05-17-2022 08:08 AM
‎05-17-2022 08:08 AM
Hi - I am a relatively novice Splunk user. I am looking at implict vs explicit audit events and looking to do a calculation based on a count of these two events. I was trying to write an eval but wasn't getting anywhere This is my search (redacted) | multisearch [| search auditSource=SOURCE auditType=TYPE 1 | regex tags.path=PATH ] [| search auditSource=SOURCE auditType=TYPE2] | stats dc(SESSIONS) as Total by auditType So, now I have a count of the sessions in both audit types, where unique sessions in TYPE1 are journey starts, and unique sessions in TYPE2 are completions. I want to calculate the completion rate so essentially what I need is the distinct session count in TYPE1 divided by the distinct session count in TYPE2.   p.s. I should note the audit sources for both are the same, and there are no other unique fields I can use instead. ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎05-19-2022 04:56 AM
Karma given to
View All