https://community.splunk.com/t5/Splunk-Search/How-to-create-a-timechart-from-calculated-value/m-p/368224#M108540 <P>I would try like this</P> <PRE><CODE>| eval Output1 = 'Value1'*10 | eval Output2 = ((10*'Value2') + 'Output1') | timechart span=1m values(Output2) by host </CODE></PRE> <P>The values function may give multivalued field if your data coming multiple times in a minute and nothing will be plotted. If that is the case you may want to different function here (min, max, avg, sum etc instead of values).</P> Tue, 21 Mar 2017 14:59:00 GMT somesoni2 2017-03-21T14:59:00Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-timechart-from-calculated-value/m-p/368221#M108537 <P>Hello I have a search to plot the calculated value over time. However the search is not working as expected. </P> <PRE><CODE>| eval Output1 = Value1 * 10 | eval Output2 = ((10 * (Value2)) + Output1) | timechart span=1m values(Output2) by host </CODE></PRE> <P>The above search is not plotting the Output2 value graph. If I just change the value for Output1 in eval Output2 then it works i.e.</P> <PRE><CODE>| eval Output2 = ((10 * (Value2)) + 10) </CODE></PRE> <P>Is there any other way to timechart calculated value?</P> Tue, 21 Mar 2017 09:59:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-timechart-from-calculated-value/m-p/368221#M108537 balendra 2017-03-21T09:59:25Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-timechart-from-calculated-value/m-p/368222#M108538 <P>could you doublecheck the format of your fields to be numeric? </P> Tue, 21 Mar 2017 13:51:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-timechart-from-calculated-value/m-p/368222#M108538 asimagu 2017-03-21T13:51:14Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-timechart-from-calculated-value/m-p/368223#M108539 <P>Output1 field is numeric too. <BR /> | eval Output1 = Value1 - 10</P> Tue, 21 Mar 2017 14:34:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-timechart-from-calculated-value/m-p/368223#M108539 balendra 2017-03-21T14:34:14Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-timechart-from-calculated-value/m-p/368224#M108540 <P>I would try like this</P> <PRE><CODE>| eval Output1 = 'Value1'*10 | eval Output2 = ((10*'Value2') + 'Output1') | timechart span=1m values(Output2) by host </CODE></PRE> <P>The values function may give multivalued field if your data coming multiple times in a minute and nothing will be plotted. If that is the case you may want to different function here (min, max, avg, sum etc instead of values).</P> Tue, 21 Mar 2017 14:59:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-timechart-from-calculated-value/m-p/368224#M108540 somesoni2 2017-03-21T14:59:00Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-timechart-from-calculated-value/m-p/368225#M108541 <P>Since the data is coming every minute with the values function there was no data. And I changed to the below query and its working now.</P> <PRE><CODE>| eval Output1 = 'Value1'*10 | eval Output2 = (10*'Value2') | timechart span=1m perc90(Output2) eval(avg(Ouput1) + avg(Output2)) as total_out by host </CODE></PRE> <P>Thanks somesoni2</P> Tue, 21 Mar 2017 21:39:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-timechart-from-calculated-value/m-p/368225#M108541 balendra 2017-03-21T21:39:59Z