Splunk Search

How to create a search that will use values from a table to calculate the percentage?

pahilw
Explorer

I have a search that outputs a number of log lines in following table format:

package      |          lineCount
_____________________________
OLD          |            333
NEW          |            120

This is the intermediate state of my data as i am looking for the percent change in number of log lines. Hence, i want to use the values from table and do some calculations for getting percent (for example (120 - 333) / 333 to calculate decrease %). I am not able to figure out how do i extract the values and use them for doing calculations. What command to use, etc?

1 Solution

gokadroid
Motivator

Can you try this:

your base query to return the table of package, lineCount
| eval dummy=""
| xyseries dummy, package, lineCount
| eval percentage=(NEW-OLD)/OLD
| table NEW, OLD, percentage

View solution in original post

gokadroid
Motivator

Can you try this:

your base query to return the table of package, lineCount
| eval dummy=""
| xyseries dummy, package, lineCount
| eval percentage=(NEW-OLD)/OLD
| table NEW, OLD, percentage

pahilw
Explorer

worked like a charm, exactly what i was looking for. Thank you.

Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...