Splunk Search

How do I combine two fields from different sources but of the same source type in a single search?

rkatsnel
New Member

I am trying to perform a ratio calculation on 2 fields (values) coming from different sources but of the same source type, Individually my searches work fine and return the correct values. But, when I combine them together, I get really weird results. Many Thanks for your help !

(sourcetype= "test" source=A host =192.168.1.1 fieldA=* ) OR source=B
eval sourceA=round(fieldA/1000),2
eval sourceB=round(fieldB/1000),2
stats max(sourceA) as SA max(sourceB) as SB
|eval percent_ratio=round(SA/SB,2)
|stats max(percent_ratio)

Legend:
fieldA (sourceA),
fieldB (sourceB)

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

To get the ratio between two maximums your search looks pretty much correct already, I'd just leave off the rounding until the very end.

source=A OR source=B
| stats max(fieldA) as maxA max(fieldB) as maxB 
| eval percent_ratio = round(maxA/maxB*100, 2) 
| fields percent_ratio

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

To get the ratio between two maximums your search looks pretty much correct already, I'd just leave off the rounding until the very end.

source=A OR source=B
| stats max(fieldA) as maxA max(fieldB) as maxB 
| eval percent_ratio = round(maxA/maxB*100, 2) 
| fields percent_ratio

martin_mueller
SplunkTrust
SplunkTrust

If that's the calculation you need, sure.

0 Karma

rkatsnel
New Member

Thanks Martin , Appreciate it !

0 Karma

rkatsnel
New Member

Appreciated ,
another question if you don't mind , what about
sum & max it shouldn't make no difference , correct ?

source=A OR source=B
| stats sum(fieldA) as sumA max(fieldB) as maxB
| eval percent_ratio = round(sumA/maxB*100, 2)
| fields percent_ratio

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Can you describe what result you're looking for?

As your search sits now, you're getting the maximums of both values, calculating the ratio of those two maximums, and then getting the maximum of that one ratio. I can't tell from that what you're actually trying to achieve, and in what way your search deviates from that goal.

0 Karma

rkatsnel
New Member

Hello Martin , Thanks for your reply

I am trying to calculate percent ratio from two max(values) belong to two diff sources and I am looking for the correct syntax on how to do that

dataset from sourceA
fieldA (value)
no fieldB

data set from sourceB
fieldB(value)
no fieldA
it should produce the following results

sourceA(max value) sourceB(max value) percent_ratio
62 200 (200/62)*100

Hope it will clarified your question

Thanks

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...