https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-normalize-the-timechart-data-by-time/m-p/533811#M9575 <P>bucket also works for me ! Thank you very much!</P> Tue, 22 Dec 2020 12:13:03 GMT Minghao 2020-12-22T12:13:03Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-normalize-the-timechart-data-by-time/m-p/531993#M9516 <P>I use the timechart to analyze the data and I want to normalize the data in the timechart</P><P>... | timechart span=3d count by step</P><P>What I get is like:</P><P>_time 1 2 3&nbsp;</P><P>11/2&nbsp; 2 3 4</P><P>11/3&nbsp; 3 4 5</P><P>And I want to divide the max value of each row and get like this:</P><P>_time 1 2 3&nbsp;</P><P>11/2&nbsp; 0.5 0.75 1</P><P>11/3&nbsp; 0.6 0.8 1</P><P>How can I get this? Thank a lot in advance</P> Fri, 04 Dec 2020 09:50:10 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-normalize-the-timechart-data-by-time/m-p/531993#M9516 Minghao 2020-12-04T09:50:10Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-normalize-the-timechart-data-by-time/m-p/532098#M9518 <P><SPAN>... | timechart span=3d count by step<BR /></SPAN>| untable _time step count<BR />| eventstats max(count) as max_count by _time<BR />| eval count=round(count/max_count,1)<BR />| xyseries _time step count</P> Sat, 05 Dec 2020 06:57:35 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-normalize-the-timechart-data-by-time/m-p/532098#M9518 to4kawa 2020-12-05T06:57:35Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-normalize-the-timechart-data-by-time/m-p/532107#M9519 <P>Try something like this:</P><P>&nbsp;</P><LI-CODE lang="markup">…| bucket span=3d _time | stats count by _time step
| eventstats max(count) as max by _time | eval count=round(count/max,2) | xyseries _time step count</LI-CODE> Sat, 05 Dec 2020 18:04:29 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-normalize-the-timechart-data-by-time/m-p/532107#M9519 somesoni2 2020-12-05T18:04:29Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-normalize-the-timechart-data-by-time/m-p/533810#M9574 <P>It does works! Thank you very much!</P> Tue, 22 Dec 2020 12:06:27 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-normalize-the-timechart-data-by-time/m-p/533810#M9574 Minghao 2020-12-22T12:06:27Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-normalize-the-timechart-data-by-time/m-p/533811#M9575 <P>bucket also works for me ! Thank you very much!</P> Tue, 22 Dec 2020 12:13:03 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-normalize-the-timechart-data-by-time/m-p/533811#M9575 Minghao 2020-12-22T12:13:03Z