Eval division of two results of the same field

[kokanne]

I want to find the ratio of failures and successful logins. Therefore I use one field in a data model, called Authentication.action. I'm using tstats.

I get two results, in a table.

Authentication.action - count
failure - 7511212
success - 1010802549

I want to use these results in an eval command to divide them between each other and find the ratio of successful logins to every failed login.

Is this possible?

[harishalipaka · Accepted solution]

hi @kokanne

try like this

if it is helpful pls accept this

|makeresults |eval Authentication="failure" ,count=7511212 | append [|makeresults |eval Authentication="success" ,count=1010802549 ] |table Authentication count 

|transpose header_field=Authentication |eval division=success/failure |transpose column_name=Authentication

[kokanne]

Also, these results are not always the same, so the hardcoded count value wouldn't work out

[harishalipaka]

@kokanne

just add that snippet code at end of your query

[kokanne]

I see, how can I get the single value of the eval output?

[harishalipaka]

@kokanne

just add |table columnname (which fields you want to display)

[kokanne]

| tstats summariesonly=true count from datamodel=Authentication by "Authentication.action" 
| search "Authentication.action"!="unknown" 
| transpose header_field=="Authentication.action" 
| eval division=success/failure 

Trying to only display division field, table division doesn't work

Edit: Found out what the problem was, it's fixed

[kokanne]

Makeresults has to be the first command in the query, but that is already being used by tstats

[kamlesh_vaghela]

@kokanne

makeresults command is just for generating data for sample search.

just try this.

YOUR_TSTATS_SEARCH
|transpose header_field=="Authentication.action"  |eval division=success/failure  

OR

YOUR_TSTATS_SEARCH
|transpose header_field=="Authentication.action"  |eval division=success/failure |transpose column_name=Authentication