Splunk Search

How do I search the count of events and use that value to calculate another field?

joydeep741
Path Finder

I wish to count the number of events and then use that value to calculate something else.

I tried something like this:

index=dotcom sourcetype=dotcom_access_log status != 2* pid=www.abc.com |
eventstats count as todayTotal |stats count(status) as todayValue by status | eval percent = (todayValue/todayTotal)*100

But todayTotal comes as empty when I use it in eval (though the bold line successfully gets the value of todayTotal).
Please suggest how can i use the value of "total number of events" (todayTotal in the case above).

woodcock
Esteemed Legend

Like this:

index=dotcom sourcetype=dotcom_access_log status != 2* pid=www.abc.com|stats count(status) as todayValue by status | eventstats sum(todayValue) AS todayTotal | eval percent = (todayValue/todayTotal)*100
0 Karma

Runals
Motivator

Move your eventstats after your stats command and change it to | eventstats sum(todayValue) as todayTotal

0 Karma

sundareshr
Legend

Does this give you what you're looking for?

index=dotcom sourcetype=dotcom_access_log pid=www.abc.com | stats count as total count(eval(status!="2*")) as statuscount | eval percent=statuscount/total*100

If you want the percentage for all status > 200 then try this

 index=dotcom sourcetype=dotcom_access_log pid=www.abc.com  status>299 | stats count by status | stats sum(count) as value by status | eventstats sum(value)  as total | eval percent=value/total*100
0 Karma

DeronJensen
Explorer

I think the search is losing the field todayTotal when it do the stats command by status. I think the search should do the stats by status, todayTotal which will also keep the todayTotal field in the results so you can calculate the percent field.

...|stats count(status) as todayValue by status,todayTotal | eval percent = (todayValue/todayTotal)*100
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...