topic timechart ratio by model in Splunk Search

timechart ratio by model

sarathipattam — Wed, 09 May 2018 19:10:40 GMT

Hi,

below is my query

index_ sourcetype=main
| stats count(eval(level="Error")) as ERRORS count(eval(level="Information")) as USAGE by Model osVersion firmware
|eval RATE=round(((EXCEEDED/REQUEST)*100),1)

and I want to time chart the ratio by this three coloums/dimensions Model, osVersion, firmware.

Can someone assist me please?

Re: timechart ratio by model

somesoni2 — Wed, 09 May 2018 19:19:15 GMT

I'm assuming there is a typo in the field names in the eval for RATE field (should be ERRORS/USAGE), so using the correct names, try like this (whatever timespan you want to use for time chart, update the same in bin and timechart command, below uses timespan of 1h or 1 hour)

index_ sourcetype=main
| bin span=1h _time
| stats count(eval(level="Error")) as ERRORS count(eval(level="Information")) as USAGE by _time Model osVersion firmware
|eval RATE=round(((ERRORS/USAGE)*100),1)
| eval Model_osVersion_firmware=Model."/".osVersion."/".firmware
| timechart span=1h avg(RATE) by Model_osVersion_firmware

Re: timechart ratio by model

sarathipattam — Wed, 09 May 2018 20:27:54 GMT

concatenate is not working for me

Re: timechart ratio by model

sarathipattam — Wed, 09 May 2018 21:20:37 GMT

i used strcat and it worked.. thank you!!