Splunk Search

How do I search the count of events and use that value to calculate another field?

joydeep741
Path Finder

I wish to count the number of events and then use that value to calculate something else.

I tried something like this:

index=dotcom sourcetype=dotcom_access_log status != 2* pid=www.abc.com |
eventstats count as todayTotal |stats count(status) as todayValue by status | eval percent = (todayValue/todayTotal)*100

But todayTotal comes as empty when I use it in eval (though the bold line successfully gets the value of todayTotal).
Please suggest how can i use the value of "total number of events" (todayTotal in the case above).

woodcock
Esteemed Legend

Like this:

index=dotcom sourcetype=dotcom_access_log status != 2* pid=www.abc.com|stats count(status) as todayValue by status | eventstats sum(todayValue) AS todayTotal | eval percent = (todayValue/todayTotal)*100
0 Karma

Runals
Motivator

Move your eventstats after your stats command and change it to | eventstats sum(todayValue) as todayTotal

0 Karma

sundareshr
Legend

Does this give you what you're looking for?

index=dotcom sourcetype=dotcom_access_log pid=www.abc.com | stats count as total count(eval(status!="2*")) as statuscount | eval percent=statuscount/total*100

If you want the percentage for all status > 200 then try this

 index=dotcom sourcetype=dotcom_access_log pid=www.abc.com  status>299 | stats count by status | stats sum(count) as value by status | eventstats sum(value)  as total | eval percent=value/total*100
0 Karma

DeronJensen
Explorer

I think the search is losing the field todayTotal when it do the stats command by status. I think the search should do the stats by status, todayTotal which will also keep the todayTotal field in the results so you can calculate the percent field.

...|stats count(status) as todayValue by status,todayTotal | eval percent = (todayValue/todayTotal)*100
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...