topic Re: How to do a simple calculation based on two form values? in Dashboards & Visualizations

How to do a simple calculation based on two form values?

apnetmedic — Thu, 06 Nov 2014 15:11:18 GMT

I've got two tokens in an input form, let's call them token1 and token2. They are each used to construct some searches, and that's all fine and good.

I'd also like to do a simple calculation based on these, like: someResult = token1 x token2 x someConstant, and display that in a single value panel.

I just can't figure out how to do that without an actual search involved. It's got to be easy... right?

Re: How to do a simple calculation based on two form values?

Raghav2384 — Mon, 28 Sep 2020 18:08:15 GMT

Can be achieved using post processing searches.
Make the selections mentioned in the search template, please refer ui examples app.

Once you have the parent search, insert a separate chart panel to do some thing like table someResult.
someResult would be (token1*token2*constant). There might be other ways to do it.

Re: How to do a simple calculation based on two form values?

apnetmedic — Thu, 06 Nov 2014 15:57:26 GMT

Even easier is probably something like:
| stats count(_raw) | eval someResult = token1 * token2 * someConstant | table someResult

That spends minimal time on the search, which returns 0 events, then stats count() returns 1 row, and my eval then produces something.

EDIT: took out an initial empty search. @somesoni2 led me there with the | gentimes | idea. That works too, really anything that will generate one row of data to throw away.

Re: How to do a simple calculation based on two form values?

somesoni2 — Thu, 06 Nov 2014 16:09:20 GMT

You can create dummy results using gentimes without hitting any actual index/sourcetype.

e.g.

|gentimes start=-1 |  eval someResult = $token1$ * $token2$ * someConstant | table someResult

Re: How to do a simple calculation based on two form values?

jlin — Thu, 06 Nov 2014 19:22:33 GMT

I believe the best way would be to use calculated fields - http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/definecalcfields

In props.conf, you could set up a calculated field such as:



[<stanza>]

EVAL-<field_name> = <eval statement>

which in your case:



[<your_stanza>]

EVAL-someResult = token1 * token2 * <someConstant>