Splunk Search

Get percentage between two graph lines over time

jizzmaster
Path Finder

I have two numbers that I am trying to get a percentage out of. One number is a count of total IPs. The other is a count of asset records. I want to know what percentage of total IPs have an asset record. That's "asset/total" for a proportion. Easy enough.

Now the part that is stumping me. I summarize the "asset" number and the "total" number each day into a summary index. So I have a running number for each. I would like to have a graph showing the "total" count, the "asset" count, and a new field, "percentage." How can I have Splunk start at 30 days back, compare these two numbers to create a percentage, then do the same things for days 29-1 and make it into a visual graph?

Here's my current attempt at doing it for just the most recent summary info. Not sure how to approach the 30 days, though.

index=summary source="assets" earliest=-1d
|eval proportion=count/[search index=summary source="total" earliest=-1d |return $count]
|table proportion
Tags (3)
0 Karma
1 Solution

bmacias84
Champion

Not exactly sure what you data looks like but here are two methods I would use.

index=summary source="assets" earliest=-1d | table count | appendcols [search index=summary source="total" earliest=-1| rename count as total | fields total] | eval proportion=count/total | table proportion

index=summary source="assets" earliest=-1d | table _time count | join _time [search index=summary source="total" earliest=-1| rename count as total | fields _time total] | eval proportion=count/total | table proportion

View solution in original post

bmacias84
Champion

Not exactly sure what you data looks like but here are two methods I would use.

index=summary source="assets" earliest=-1d | table count | appendcols [search index=summary source="total" earliest=-1| rename count as total | fields total] | eval proportion=count/total | table proportion

index=summary source="assets" earliest=-1d | table _time count | join _time [search index=summary source="total" earliest=-1| rename count as total | fields _time total] | eval proportion=count/total | table proportion

jizzmaster
Path Finder

I went with the 2nd option as I'm not very familiar with appendcols and it didn't work immediately for me. It said I had to use a chart option instead of a table. But the 2nd option with the join works great. Thank you.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...