Hello experts.
I tried to execute the query, as described here https://answers.splunk.com/answers/106906/how-to-perform-math-on-single-values.html
In my case, too, there are two requests.
1st search:
index=ns SUBMIT_SM REQUEST host="notif*" | rex field=_raw "CID\:(?.*)\ actor-id" | dedup CID
| stats count as part
2nd search:
index=ns SUBMIT_SM REQUEST host="notif*" | stats count as uniq
I tried to combine these requests into one to calculate the ratio
| multisearch
[ search index=ns SUBMIT_SM REQUEST host="notif*" | rex field=_raw "CID\:(?.*)\ actor-id" | dedup CID
| eval marker="s" ]
[ search index=ns SUBMIT_SM REQUEST host="notif*"
| eval marker="o" ]
| stats count(eval(marker=="s")) as part
count(eval(marker=="o")) as uniq
| eval velocity=(part/uniq)*100)
I receive an error:
Error in 'multisearch' command: Multisearch subsearches may only contain purely streaming operations (subsearch 1 contains a non-streaming command.)
The search job has failed due to an error. You may be able to see the job in the Job Inspector.
I tried it differently
index=ns SUBMIT_SM REQUEST host="notif*"
| stats count as part
| append [ search index=ns SUBMIT_SM REQUEST host="notif*" | rex field=_raw "CID\:(?.*)\ actor-id" | dedup CID | stats count as uniq] | eval velocity=part/uniq
But velocity was not calculated
Help
↧