splunksplunk-querysplunk-formula

SPLUNK enterprise i am trying to calculate results where if > 4% of failure is anomaly?

SPLUNK enterprise i am trying to calculate results where > 4% of failure is anomaly. is formula correct? to set anomaly ?(failcount and total count fields are numeric)

| inputlookup sample.csv | eval isananomaly = if('Failcount' / 'Totalcount' * 100 > 4 , 1 , 0)

Solution

  • The logic appears correct, but why multiply by 100?

    Save yourself a step:

    | inputlookup sample.csv 
| eval isananomaly = if((Failcount / Totalcount) > .04 , 1 , 0)