Hello,
I've a requirement to perform the following calculation in percentage.
First query is as below and single value result is 50
index=*
| rex field=_raw "Product ABC.*client\=(?<client>[\w+]+)"
| stats count(client) as Count
Then I've another query and single value result is 10:
index=*
| rex field=_raw "Broken Product.*productid\=(?<productid>[\w+]+)"
| stats count(productid)
I need to perform the calculation based on the result of above 2 queries. The calculation formula should be 10/50 = 20%. How can I achieve it to come out with 20% as the output of the calculation in Splunk?
Thanks.
try this:
index=*|rex field=_raw "Product ABC.*client\=(?<client>[\w+]+)"
| rex field=_raw "Broken Product.*productid\=(?<productid>[\w+]+)"
| stats count(client) as clientcount , count(productid) as productcount
|eval percentage=((productcount/clientcount)*100)."%"
try this:
index=*|rex field=_raw "Product ABC.*client\=(?<client>[\w+]+)"
| rex field=_raw "Broken Product.*productid\=(?<productid>[\w+]+)"
| stats count(client) as clientcount , count(productid) as productcount
|eval percentage=((productcount/clientcount)*100)."%"
Hi @493669,
It's work! Thank you. Can you update as answer so that I can accept it officially?