topic Re: eval and timechart in Splunk Search

eval and timechart

sphiwee — Sun, 20 Jun 2021 18:00:11 GMT

How can I get STP as a bar chart ? im getting error when i try to do it like this

i want to display STP for each month

Re: eval and timechart

sphiwee — Sun, 20 Jun 2021 18:02:19 GMT

here's the spl query

index="acoe_np_spa_metrics"| search Project="*" AND Volume="*" |bin _time span=1month | stats
count(eval(D_Status="F")) as success_count
count(eval(D_Status="S")) as failure_count | eval TOTAL_COUNT=(success_count + failure_count) | eval STP=(success_count/TOTAL_COUNT)*100 | timechart STP

Re: eval and timechart

bowesmana — Mon, 21 Jun 2021 04:14:25 GMT

There's no need to use stats/bin, you can do it all with timechart and post calculations.

index="acoe_np_spa_metrics" | search Project="*" AND Volume="*" | timechart span=1mon count(eval(D_Status="F")) as success_count count(eval(D_Status="S")) as failure_count count as Total | eval STP=(success_count/Total)*100 | fields - Total

So generate the timechart and include the Total count per month also, then just calculate the success percentage at the end and then remove the Total field if you don't want it.

Note that this assumes Total will be the same as success+failure - if not, then calculate Total afterwards instead.

Re: eval and timechart

sphiwee — Mon, 21 Jun 2021 10:18:36 GMT

Thanks it works, but seems I actually had to get the sum of the volume where D_status = F and sum of volume where D_Status = S...

How can I achieve this?

Re: eval and timechart

bowesmana — Tue, 22 Jun 2021 00:55:10 GMT

If you want to get the total success/failure counts not split by month then just add an eventstats at the end

| eventstats sum(success_count) as total_success_count sum(failure_count) as total_failure_count

is that what you are after?