Hi team,
I have a below sample raw events in splunk.
2020-11-30 19:15:26,726 ratingEnabled="[performance]"
2020-11-30 15:59:13,827 ratingEnabled="[objective,competency]" ratingEnabledGuideline="[objectiveGuideline]"
2020-11-30 05:34:40,986 ratingEnabled="[performance]" ratingEnabledGuideline="[performanceGuideline]"
stats requirement:
I want to get a ratio that enabled guideline per each rating. For example: analyze above sample events,
1. there are 3 ratings enabled(refer to ratingEnabled field): performance, objective and competency
2. there're 2 ratings enabled guideline(refer to ratingEnabledGuideline field): objective and performance
So the expected result I want splunk to return is:
ratingEnabled | count | count - enabled Guideline | ratio - enabled guideline |
performance | 2 | 1 | 50% |
objective | 1 | 1 | 100% |
competency | 1 | 0 | 0% |
How to stats the ratio in this scenario?
| rex max_match=0 field=ratingEnabled "(?<ratingEnabled>[^\[,\]]+)"
| mvexpand ratingEnabled
| rex field=ratingEnabledGuideline "(?<guideline>[^\[]+)Guideline"
| eval guided=if(ratingEnabled=guideline,1,0)
| stats count sum(guided) as guided by ratingEnabled
| eval ratio=guided*100/count
| rex max_match=0 field=ratingEnabled "(?<ratingEnabled>[^\[,\]]+)"
| mvexpand ratingEnabled
| rex field=ratingEnabledGuideline "(?<guideline>[^\[]+)Guideline"
| eval guided=if(ratingEnabled=guideline,1,0)
| stats count sum(guided) as guided by ratingEnabled
| eval ratio=guided*100/count