Splunk Search

Is the following calculation possible ?

luckyman80
Path Finder

I'm currently generating an AvgTime of processing cycles in a thread within a 5 min duration and writing these out to a log similar to this

[PrepareEvents, DispatchAll]

PrepareEvents samples Avg: 2757ns; Median: 1411ns; Max: 1533433ns; Total Events: 277138; Total Items: 314155

I want to perform the following calculation so i find out how many average ns i've spent processing cycles in the 5min duration

avgTime (multiply i cant add star here) Total items * 100 / (5 min in nanos

Can i do this in splunk ?

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @luckyman80

Does this do what you need: <your search> | rex "Avg:\s*(?<avg>\d+)ns;\s*Median:\s*(?<median>\d+)ns;\s*Max:\s*(?<max>\d+)ns;\s*Total Events:\s*(?<total_events>\d+);\s*Total Items:\s*(?<total_items>\d+)" | eval result = (avg * total_items) / 300000000000

All the best, Chris.

View solution in original post

luckyman80
Path Finder

actually i see the issue. it seems the percentage calculation is missing from your first example

Total items * 100

how do I make this a percentage ?

0 Karma

DMohn
Motivator

If you just need the results to be displayed as a percentage you can add a | eval result = result." %" to the search string.

This can even be used for rounding down if needed: |eval result = round(result,2)." %"

0 Karma

luckyman80
Path Finder

Thanks guys this looks good one last ask .. sorry for all the questions.. do you know how to turn the result into a percentage rather then raw value ?

0 Karma

luckyman80
Path Finder

Hi Chris, Thanks for your prompt response. How do I show the result from the calculation only ?

Thanks again

Paul

0 Karma

DMohn
Motivator

just add a |table result to the search Chris provided!

chrisyounger
SplunkTrust
SplunkTrust

Hi Paul

<your search> | rex "Avg:\s*(?<avg>\d+)ns;\s*Median:\s*(?<median>\d+)ns;\s*Max:\s*(?<max>\d+)ns;\s*Total Events:\s*(?<total_events>\d+);\s*Total Items:\s*(?<total_items>\d+)" | eval result = (avg * total_items) / 300000000000 | table result

chrisyounger
SplunkTrust
SplunkTrust

Hi @luckyman80

Does this do what you need: <your search> | rex "Avg:\s*(?<avg>\d+)ns;\s*Median:\s*(?<median>\d+)ns;\s*Max:\s*(?<max>\d+)ns;\s*Total Events:\s*(?<total_events>\d+);\s*Total Items:\s*(?<total_items>\d+)" | eval result = (avg * total_items) / 300000000000

All the best, Chris.

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...