Splunk Search

I need a single value after dividing 2 results which we obtain as a result of stats dc. As of now, I see 3 values.

prateedshetty
Path Finder

The query I use is-

sourcetype=iis URL_root=abc "https://www.abc.com"|stats dc(SessionId) as TotalVisits, dc(userid) as TotalUsers|eval AvgVisit=TotalVisits/TotalUsers

So the final result I see has 1 row but with 3 values-one each for TotalVisits, Totalusers and AvgVisit. But in the dashboard all I need is the AvgVisit value. This is to calculate the average visit per visitor value. Using the single Value panel in the dashboard displays the first value i.e TotalVisits. Please help!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

You just need to add a table command at the end of your search to list the fields that you want to display (and in which order).

sourcetype=iis URL_root=abc "https://www.abc.com"|stats dc(SessionId) as TotalVisits, dc(userid) as TotalUsers|eval AvgVisit=TotalVisits/TotalUsers | table AvgVisit

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You just need to add a table command at the end of your search to list the fields that you want to display (and in which order).

sourcetype=iis URL_root=abc "https://www.abc.com"|stats dc(SessionId) as TotalVisits, dc(userid) as TotalUsers|eval AvgVisit=TotalVisits/TotalUsers | table AvgVisit
0 Karma

prateedshetty
Path Finder

Thanks! It worked as I wanted it to.. 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...