https://community.splunk.com/t5/Splunk-Search/how-can-I-get-the-per-hour-results-of-the-sum-of-max-value-per/m-p/291740#M162825 <P>@HiroshiSatoh, thanks for your reply. I need to get the sum /avg of the 10 locations per hour. </P> <P>When I use "max(emptylocation" per hour using bin time or timechart, it only returns one max value among the 10 locations. What I need is the sum of the max value per location per hour, does it make sense?</P> Tue, 20 Feb 2018 07:08:19 GMT auaave 2018-02-20T07:08:19Z https://community.splunk.com/t5/Splunk-Search/how-can-I-get-the-per-hour-results-of-the-sum-of-max-value-per/m-p/291738#M162823 <P>Hi Guys,</P> <P>I have 10 locations with around 100 spaces each then every 10 mins a new message is sent to update the current empty and available locations. I want to get the maximum total empty and available locations and percentage across all locations per hour.</P> <P>With the below query, I was able to get the total number of empty, filled, %empty and %filled at the end of the day. how can I get similar results per hour? thank you</P> <PRE><CODE>| chart eval(max(EMPTYLOCATIONS)) as empty eval(max(LOCATIONS)-max(EMPTYLOCATIONS)) as filled eval(max(EMPTYLOCATIONS)/max(LOCATIONS)*100) as P_EMPTY eval((max(LOCATIONS)-max(EMPTYLOCATIONS))/max(LOCATIONS)*100) as P_OCCUPIED by location | appendpipe [| stats sum(filled) as filled sum(empty) as empty avg(P_EMPTY) as P_EMPTY avg(P_OCCUPIED) as P_OCCUPIED | eval location="all_locations"] </CODE></PRE> Tue, 20 Feb 2018 05:24:53 GMT https://community.splunk.com/t5/Splunk-Search/how-can-I-get-the-per-hour-results-of-the-sum-of-max-value-per/m-p/291738#M162823 auaave 2018-02-20T05:24:53Z https://community.splunk.com/t5/Splunk-Search/how-can-I-get-the-per-hour-results-of-the-sum-of-max-value-per/m-p/291739#M162824 <P>For example, is this like?</P> <PRE><CODE> | bin span=1h _time | stats eval(max(EMPTYLOCATIONS)) as empty eval(max(LOCATIONS)-max(EMPTYLOCATIONS)) as filled eval(max(EMPTYLOCATIONS)/max(LOCATIONS)*100) as P_EMPTY eval((max(LOCATIONS)-max(EMPTYLOCATIONS))/max(LOCATIONS)*100) as P_OCCUPIED by location,_time | appendpipe [| stats sum(filled) as filled sum(empty) as empty avg(P_EMPTY) as P_EMPTY avg(P_OCCUPIED) as P_OCCUPIED by _time | eval location="all_locations"] | sort _time </CODE></PRE> Tue, 20 Feb 2018 06:39:59 GMT https://community.splunk.com/t5/Splunk-Search/how-can-I-get-the-per-hour-results-of-the-sum-of-max-value-per/m-p/291739#M162824 HiroshiSatoh 2018-02-20T06:39:59Z https://community.splunk.com/t5/Splunk-Search/how-can-I-get-the-per-hour-results-of-the-sum-of-max-value-per/m-p/291740#M162825 <P>@HiroshiSatoh, thanks for your reply. I need to get the sum /avg of the 10 locations per hour. </P> <P>When I use "max(emptylocation" per hour using bin time or timechart, it only returns one max value among the 10 locations. What I need is the sum of the max value per location per hour, does it make sense?</P> Tue, 20 Feb 2018 07:08:19 GMT https://community.splunk.com/t5/Splunk-Search/how-can-I-get-the-per-hour-results-of-the-sum-of-max-value-per/m-p/291740#M162825 auaave 2018-02-20T07:08:19Z https://community.splunk.com/t5/Splunk-Search/how-can-I-get-the-per-hour-results-of-the-sum-of-max-value-per/m-p/291741#M162826 <P>I do not know what it is. It specifies ”by location,_time”, so it will be a separate location.</P> Tue, 20 Feb 2018 11:37:57 GMT https://community.splunk.com/t5/Splunk-Search/how-can-I-get-the-per-hour-results-of-the-sum-of-max-value-per/m-p/291741#M162826 HiroshiSatoh 2018-02-20T11:37:57Z https://community.splunk.com/t5/Splunk-Search/how-can-I-get-the-per-hour-results-of-the-sum-of-max-value-per/m-p/291742#M162827 <P>@HiroshiSatoh, not sure but it's not working. I tried the other way, I was able to get the "empty" column with the sum of max value of empty space per locations per hour... my problem now is, I can't add the column for total filled, %empty and %filled </P> <PRE><CODE>| bin span=1h _time | chart eval(max(EMPTYLOCATIONS)) as empty _time by aisle limit=0 | addtotals | rename Total as empty_total | fields _time empty_total | appendcols [ | chart eval(max(LOCATIONS)-(max(EMPTYLOCATIONS)) as totalfilled over _time by aisle |addtotals |rename Total as totalfilled| fields totalfilled] </CODE></PRE> Tue, 20 Feb 2018 12:31:24 GMT https://community.splunk.com/t5/Splunk-Search/how-can-I-get-the-per-hour-results-of-the-sum-of-max-value-per/m-p/291742#M162827 auaave 2018-02-20T12:31:24Z https://community.splunk.com/t5/Splunk-Search/how-can-I-get-the-per-hour-results-of-the-sum-of-max-value-per/m-p/291743#M162828 <P>I do not really understand from the search sentence.<BR /> Can I present samples of input and output images?</P> Tue, 20 Feb 2018 12:40:26 GMT https://community.splunk.com/t5/Splunk-Search/how-can-I-get-the-per-hour-results-of-the-sum-of-max-value-per/m-p/291743#M162828 HiroshiSatoh 2018-02-20T12:40:26Z