Splunk Search

Division of two sums - subfield parsed out of a field

splunk_zen
Builder

Let's say I have a .csv content of the following structure,

PROCESS_5 (qa_cluster1server3),1,100,131,2012-10-01 15:50:00  
PROCESS_6 (qa_cluster2server2),2,100,97,2012-10-01 15:50:00
....

I need to parse the cluster from which the data belongs out of the first comma delimited value,

source=*output/ora_queries/cluster10/processKpis.csv
| rex field=module_name "(?<server>PROCESS[0-9]qa_server)"
| timechart span=2h sum(EVOCATIONS) by server

which gets the following output,

_time                   qa_cluster1 qa_cluster2
01/10/2012 11:00:00.000 17785   34852
01/10/2012 11:05:00.000 17529   35039
....

But how can I get the ratio evolution between each different cluster?
(dividing the sum(EVOCATIONS) of one server by the other)

Tags (4)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Use eval something like this:

source=*output/ora_queries/cluster10/processKpis.csv
| rex field=module_name "(?<server>PROCESS[0-9]qa_server)"
| timechart span=2h sum(EVOCATIONS) by server
| eval ratio=qa_cluster1 / qa_cluster2

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Use eval something like this:

source=*output/ora_queries/cluster10/processKpis.csv
| rex field=module_name "(?<server>PROCESS[0-9]qa_server)"
| timechart span=2h sum(EVOCATIONS) by server
| eval ratio=qa_cluster1 / qa_cluster2

splunk_zen
Builder

Thanks dwadlle.
It IS easy... I was overcomplicating it.
I just had to filter the fields to get the graph I intended.

source=*output/ora_queries/cluster10/processKpis.csv
| rex field=module_name "(?PROCESS[0-9]qa_server)"
| timechart span=2h sum(EVOCATIONS) by server
| eval ratio=qa_cluster1 / qa_cluster2
| fields _time, EvocationRatio

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...