topic Re: timechart to display calculated values in Splunk Search

timechart to display calculated values

kirrusk — Fri, 26 Jun 2020 15:50:59 GMT

Trying to display Percentages on Timechart , but it's not working.

Base search | fields APP Usage_kb | eval Usage_gb= round(Usage_kb/1024/1024, 5) | timechart count by APP.

it's not working.

I want to display timechart for Usage_gb per APP.

please help me.

skoelpin — Fri, 26 Jun 2020 16:02:21 GMT

Pass the eval AFTER the timechart. The eval will do the math on a column by column basis

| fields APP Usage_kb | timechart max(Usage_kb) AS Usage_kb by APP | eval Usage_gb= round(Usage_kb/1024/1024, 5)

kirrusk — Fri, 26 Jun 2020 16:16:28 GMT

Thankyou, but it's not giving data in Usage_gb , displaying data in Usage_kb only

kirrusk — Fri, 26 Jun 2020 16:29:40 GMT

i got it

basesearch | fields APP Usage_kb | eval Usage_gb = round(Usage_kb/1024/1024, 5) | timechart span = 1d max(Usage_gb) AS Usage_gb by APP.

it's working.