- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to use eval to find percentage and combine wit...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to use eval to find percentage and combine with a stats search to set up an alert?
I'm trying to setup an alert where if x/y <=x% then it sends an alert out.
To do this i'm trying to pull numbers from two separate searches to divide them to get the percentage. But i'm having trouble figuring out what commands to use to do this.
1st search - This is the total number of machine that exist
index=totalmachines sourcetype=Machines earliest=-48h@d |stats sum(linecount) AS Number_Of__Machines
2nd search - This is the limit of machines we can reach. I want to use the EVAL command to be able to see when I come close to this limit.
index=licenselimit sourcetype=LicenseLimitforMachines earliest=-48h@d | rename LIC_SOFT_LIMIT AS License_Limit | table License_Limit
I have the numbers I just need to figure out how to combine those searches and run the eval command to get a percentage.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you're just getting one row from licenselimit search as well (you're getting one row from totalmachines search) then try this
index=licenselimit sourcetype=LicenseLimitforMachines earliest=-48h@d | rename LIC_SOFT_LIMIT AS License_Limit | table License_Limit | appendcols [search index=totalmachines sourcetype=Machines earliest=-48h@d |stats sum(linecount) AS Number_Of__Machines] | eval percentage=(Number_Of_Encrypted_Machines/LIC_SOFT_LIMIT)*100
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I tried this but it still returns 2 rows with each of those fields. From what I can tell it's not doing that calculation.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I believe i'm a bit closer here
index=licenselimit earliest=-48h@d | where LIC_SOFT_LIMIT != "" | table LIC_SOFT_LIMIT | append [search index=licenselimit sourcetype=MachineTotals earliest=-48h@d |stats sum(linecount) AS Number_Of_Encrypted_Machines] | eval percentage=(Number_Of_Encrypted_Machines/LIC_SOFT_LIMIT)*100
When I run this command it just shows the two fields Number_Of_Encrypted_Machines and LIC_SOFT_LIMIT in a table. Can anyone else how I can make my eval work so I can divide Number Of Encrypted Machines by LIC_SFOT_LIMIT?
.conf24 | Registration Open!
ICYMI - Check out the latest releases of Splunk Edge Processor
Introducing the 2024 SplunkTrust!
