topic Re: Why does this chart work, but this table doesn't? in Splunk Search

Why does this chart work, but this table doesn't?

CarbonCriterium — Wed, 07 Oct 2020 22:32:39 GMT

I would like to apply a formula to each of the values in the field "stocks." I have been able to show this in a chart, but I need it as a table... what is going on here?

The values in day_hour and stocks are strings. Flow is a numeric value. Pct should be a numeric value.

| chart sum(eval(flow*100))AS pct BY day_hour stocks

The charting command produces the following. This is how I want my table to look.

day_hour	stock_name_A	stock_name_B	stock_name_C
2020-01-01 00:00
2020-01-01 01:00
2020-01-01 02:00

Instead, my table looks like this:

day_hour	stocks	pct
2020-01-01 00:00	stock_name_A
2020-01-01 00:00	stock_name_B
2020-01-01 00:00	stock_name_C
2020-01-01 01:00	stock_name_A
2020-01-01 01:00	stock_name_B
2020-01-01 01:00	stock_name_C
2020-01-01 02:00	stock_name_A
2020-01-01 02:00	stock_name_B
2020-01-01 02:00	stock_name_C

Re: Why does this chart work, but this table doesn't?

renjith_nair — Thu, 08 Oct 2020 04:16:26 GMT

Try

| chart sum(eval(flow*100))AS pct over day_hour BY stocks

Re: Why does this chart work, but this table doesn't?

CarbonCriterium — Fri, 09 Oct 2020 14:32:18 GMT

Thank you for your reply @renjith_nair but I am trying to create a table. The chart command I am using creates the intended format... but the table command does not.

Do you know why this is happening?

Re: Why does this chart work, but this table doesn't?

ITWhisperer — Fri, 09 Oct 2020 15:00:16 GMT

| xyseries day_hour stocks pct

Re: Why does this chart work, but this table doesn't?

renjith_nair — Mon, 12 Oct 2020 08:19:30 GMT

Have you tried chart over? What happens when you change visualization to stats/table.

Please find attached .

Re: Why does this chart work, but this table doesn't?

CarbonCriterium — Wed, 14 Oct 2020 15:30:32 GMT

I solved this with a workaround that may not be the most "splunkable" solution, but provides the answer results I am looking for.

|eval splitfield=stocks+"_pct" |stats sum(eval(flow*100))AS pct BY day_hour splitfield |table day_hour pct splitfield |eval {splitfield}=pct |fields -splitfield,pct |stats values(*) AS * BY day_hour |fillnull |addtotals