https://community.splunk.com/t5/Splunk-Search/Timechart-values-using-an-eval-field/m-p/501369#M139598 <P>Because _time does not exist.<BR /> Add "bin span = month _time" and "stats XXX by _time".</P> <PRE><CODE> | stats dc(ticket_number) as "score" | eval r = 1 ↓ | bin span=month _time | stats dc(ticket_number) as "score" by _time | eval r = 1 </CODE></PRE> Mon, 14 Oct 2019 09:19:47 GMT HiroshiSatoh 2019-10-14T09:19:47Z https://community.splunk.com/t5/Splunk-Search/Timechart-values-using-an-eval-field/m-p/501368#M139597 <P>Hello all, </P> <P>I have a search that goes like this:</P> <PRE><CODE>index="_internal" (ticket_type="Incident") (classification="level-1" OR classification="level-2") (ticket_status="Closed" OR ticket_status="Resolved") | stats dc(ticket_number) as "score" | eval r = 1 | append [ search index="_internal" (ticket_type="Incident") (classification="level-1" OR classification="level-2") (NOT ticket_status="Cancelled") (ticket_contract="Breached") | stats dc(ticket_number) as "missed" | eval r = 1 ] | append [ search index="_internal" (ticket_type="Incident") (classification="level-1" OR classification="level-2") (ticket_status="Closed" OR ticket_status="Resolved") (NOT ticket_source="Alert") `comment("Priority Level 1 and 2 - Excluding Alerts)")` | stats dc(ticket_number) as "score" | eval r = 2 ] | append [ search index="_internal" (ticket_type="Incident") (classification="level-1" OR classification="level-2") (NOT ticket_status="Cancelled") (sla_response="Breached") (NOT ticket_source="Alert") | stats dc(ticket_number) as "missed" | eval r = 2 ] | append [ search index="_internal" (ticket_type="Incident") (classification="level-1") (ticket_status="Closed" OR ticket_status="Resolved") | stats dc(ticket_number) as "score" | eval r = 3 ] | append [ search index="_internal" (ticket_type="Incident") (classification="level-1") (NOT ticket_status="Cancelled") (ticket_contract="Breached") | stats dc(ticket_number) as "missed" | eval r = 3 ] | append [ search index="_internal" (ticket_type="Incident") (classification="level-2") (ticket_status="Closed" OR ticket_status="Resolved") | eval r = 4 ] | append [ search index="_internal" (ticket_type="Incident") (classification="level-2") (NOT ticket_status="Cancelled") (ticket_contract="Breached") | stats dc(ticket_number) as "missed" | eval r = 4 ] | append [ search index="_internal" (ticket_type="Incident") (classification="level-2") (ticket_status="Closed" OR ticket_status="Resolved") (NOT ticket_source="Alert") `comment("Priority 2 - Excluding Alerts")` | stats dc(ticket_number) as "score" | eval r = 5 ] | append [ search index="_internal" (ticket_type="Incident") (classification="level-2") (NOT ticket_status="Cancelled") (ticket_contract="Breached") (NOT ticket_source="Alert") | stats dc(ticket_number) as "missed" | eval r = 5 ] | append [ search index="_internal" (ticket_type="Incident") (classification="level-3") (ticket_status="Closed" OR ticket_status="Resolved") | stats dc(ticket_number) as "score" | eval r = 6 ] | append [ search index="_internal" (ticket_type="Incident") (classification="level-3") (NOT ticket_status="Cancelled") (ticket_contract="Breached") | stats dc(ticket_number) as "missed" | eval r = 6 ] | append [ search index="_internal" (ticket_type="Incident") (classification="level-3") (ticket_status="Closed" OR ticket_status="Resolved") | stats dc(ticket_number) as "score" | eval r = 7 ] | append [ search index="_internal" (ticket_type="Incident") (classification="level-3") (NOT ticket_status="Cancelled") (ticket_contract="Breached") (NOT ticket_source="Alert") | stats dc(ticket_number) as "missed" | eval r = 7 ] | selfjoin r | eval met = score - missed | eval performance = round((met / score) * 100, 2) </CODE></PRE> <P>I am able to get the performance just fine.<BR /> However, I have to get the value of performance every month. I have tried:</P> <PRE><CODE>| timechart span=1mon list(performance) as performance </CODE></PRE> <P>...but nothing gets returned.</P> <P>Can anybody please point me in the right direction?</P> <P>Thank you. </P> Mon, 14 Oct 2019 06:56:16 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-values-using-an-eval-field/m-p/501368#M139597 dojiepreji 2019-10-14T06:56:16Z https://community.splunk.com/t5/Splunk-Search/Timechart-values-using-an-eval-field/m-p/501369#M139598 <P>Because _time does not exist.<BR /> Add "bin span = month _time" and "stats XXX by _time".</P> <PRE><CODE> | stats dc(ticket_number) as "score" | eval r = 1 ↓ | bin span=month _time | stats dc(ticket_number) as "score" by _time | eval r = 1 </CODE></PRE> Mon, 14 Oct 2019 09:19:47 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-values-using-an-eval-field/m-p/501369#M139598 HiroshiSatoh 2019-10-14T09:19:47Z