Splunk Search

How to combine two values from separate searches to get an average?

jmonroe516
Engager

I have 2 searches

index=test field1=abc field2=xyc | stats dc(field3) as Devices

and

index=test field1=abc field2=xyc (field6=1111 OR field6=2222) | stats dc(field4) as Connections

I'm trying to take the number from the first search and the number from the second search, which is more filtered, and get an average, specifically an average of the specific connections per device. The device may not have the specific connections, but I need an average even on devices that may not have that specific connection.

I have tried using something like return, but when I combine it, it doesn't seem to like to return anything or use it in an eval like if I do | eval Average=Connections/Devices

Is there any way to combine these 2 into one search and get the values I need?

1 Solution

stephanefotso
Motivator

with the join command, test this: index=test field1=abc field2=xyc | stats dc(field3) as Devices|join [search index=test field1=abc field2=xyc (field6=1111 OR field6=2222)|stats dc(field4) as Connections] | eval Average=Connections/Devices

here is an example in the _internal index, that you can take as a template.

index=_internal source=*metrics.log group=search_concurrency|stats dc(active_hist_searches) as ActiveHitSearch|join  [search index=_internal source=*metrics.log group=search_concurrency (component=Metrics OR component=view)|stats dc(active_realtime_searches) as ActiveRealtimeSearch] |eval average=ActiveHitSearch/ActiveRealtimeSearch
SGF

View solution in original post

stephanefotso
Motivator

with the join command, test this: index=test field1=abc field2=xyc | stats dc(field3) as Devices|join [search index=test field1=abc field2=xyc (field6=1111 OR field6=2222)|stats dc(field4) as Connections] | eval Average=Connections/Devices

here is an example in the _internal index, that you can take as a template.

index=_internal source=*metrics.log group=search_concurrency|stats dc(active_hist_searches) as ActiveHitSearch|join  [search index=_internal source=*metrics.log group=search_concurrency (component=Metrics OR component=view)|stats dc(active_realtime_searches) as ActiveRealtimeSearch] |eval average=ActiveHitSearch/ActiveRealtimeSearch
SGF

jmonroe516
Engager

That worked perfectly, thank you for the help!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...