Splunk Search

"Field1" can have one value as either yes or no. Calculate count for yes as count1 and count for no

VS0909
Communicator

"Field1" can have one value as either 'yes' or 'no'. I want to calculate count for 'yes' as count1 and count for 'no'  as count2. Then calculate the ratio of count1 and count2.

Any pointers please

Labels (6)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
...
| eval count1=if(Field1="yes",1,0)
| eval count2=if(Field2="yes",1,0)
| stats sum(count1) as count1, sum(count2) as count2
| eval ratio=count1/count2
| fields ratio

View solution in original post

VS0909
Communicator

@ITWhisperer  Thanks! Appreciate it

0 Karma

VS0909
Communicator

@ITWhisperer  Thanks for the reply.

I am trying to do the above for two fields - field1 and field2 in a single spunk query, but somehow facing issues. 

"Field1" can have one value as either 'yes' or 'no'. "Field2" can have one value as either 'yes' or 'no'.

I want to calculate count for 'yes' as count1 for field1

and count for 'yes'  as count2 for field2. Then calculate the ratio of count1 and count2.

Any pointers please

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
...
| eval count1=if(Field1="yes",1,0)
| eval count2=if(Field2="yes",1,0)
| stats sum(count1) as count1, sum(count2) as count2
| eval ratio=count1/count2
| fields ratio

ITWhisperer
SplunkTrust
SplunkTrust
| stats count by Field1
| eval count1=if(Field1="yes",count,NULL()) 
| eval count2=if(Field1="no",count,NULL()) 
| fields count1, count2 
| stats values(*) as * 
| eval ratio=count1/count2
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...