topic Re: Percentage Timechart in Splunk Search

Percentage Timechart

tkwaller — Thu, 19 Sep 2013 13:41:22 GMT

Hello

I'm trying to add a percentage for each day. Here is what I have:

index=tt OrderIntegration.asmx "PlaceOrderResponse" ("RealTime" OR "AdvancedSale") | timechart span=1d count(eval(searchmatch("RealTime"))) as NumberofRealTimeListings, count(eval(searchmatch("AdvancedSale"))) as NumberofNonRealTimeListings, sum(eval("NumberofNonRealTimeListings"/"NumberofRealTimeListings")) as Percent

Any ideas what I'm missing?

Re: Percentage Timechart

gfuente — Thu, 19 Sep 2013 13:45:36 GMT

Hello

Have you tried to eval the percentage after the timechart, like:

index=tt OrderIntegration.asmx "PlaceOrderResponse" ("RealTime" OR "AdvancedSale") | timechart span=1d count(eval(searchmatch("RealTime"))) as NumberofRealTimeListings, count(eval(searchmatch("AdvancedSale"))) as NumberofNonRealTimeListings | eval Percent = (NumberofNonRealTimeListings/NumberofRealTimeListings)*100

Regards

Re: Percentage Timechart

kristian_kolb — Thu, 19 Sep 2013 13:48:16 GMT

also, I think you should remove the double quotes around the field names in the eval.

Re: Percentage Timechart

gfuente — Thu, 19 Sep 2013 13:49:25 GMT

You are right! edited the answer

Re: Percentage Timechart

tkwaller — Thu, 19 Sep 2013 13:51:51 GMT

Yes when I did this I got "Error in 'eval' command: Typechecking failed. '/' only takes numbers."

Re: Percentage Timechart

tkwaller — Thu, 19 Sep 2013 13:55:51 GMT

I actually got that after I added that comment. Thanks for the direction!

Re: Percentage Timechart

chandusubash — Thu, 02 Mar 2017 08:51:47 GMT

How can I use this percentage and plot it in a timechart ? Can someone help.