Splunk Search

Weight host using lookup table.

jevenson
Path Finder

I'm trying to get a weighted ratio of errors per server. I have a lookup table like this:

host,percent
server1,25
server2,25
server3,50

Normally I'd do something like sourcetype=iis sc_status=500 [| inputlookup ratio | fields host] | chart count by host, which gives me a count of errors by server, but I want a weighted count based on that percent.

How would I use the lookup table to multiply the errors on a per server basis?

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Hi! 🙂

So, if what you want to do it multiply the count by the defined percent value for each of these hosts, you could do something like:

sourcetype=iis sc_status=500 [| inputlookup ratio | fields host] | lookup yourlookuptable host OUTPUT percent | chart count by host | eval weightedcount=count*percent/100

View solution in original post

Ayn
Legend

Hi! 🙂

So, if what you want to do it multiply the count by the defined percent value for each of these hosts, you could do something like:

sourcetype=iis sc_status=500 [| inputlookup ratio | fields host] | lookup yourlookuptable host OUTPUT percent | chart count by host | eval weightedcount=count*percent/100
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...