topic eval values of a formula in a timechart command in Splunk Search

eval values of a formula in a timechart command

mtrochym — Tue, 29 Sep 2020 12:58:31 GMT

Hi,
I am using the below query to timechart the values of offers (STATUS=ACCEPTED) from midnight, of the current day, and compare them to lastweek. I had found this query on these forums, plugged it in and it works beautifully!

index="offers" STATUS="ACCEPTED" earliest=-7d@d

| eval StartTime=relative_time(now(), "@d")

| eval Series=case(
_time >=StartTime, "today",
_time <= relative_time(now(), "-6d@d"), "LastWk")

| timechart span=5m count by Series

| eval Time = strftime(_time, "%H:%M")

| chart sum(LastWk) as LastWeek, sum(today) as Today by Time
| eval Today=if(Today==0, "", Today)

My problem is I am trying to insert the below "eval Percent..." so I can compare "Percent" today vs lastweek, in the above "Series".
count(STATUS) AS total, count(eval(STATUS="ACCEPTED")) AS Accepted
eval Percent=((Accepted/total)*100)

I tried timewrap, but while that is nice, it is a super slow process and only compares a 24h "moving window"

I tried doing things like:
| timechart span=5m count(STATUS) AS total, count(eval(STATUS="ACCEPTED")) AS Accepted by Series

|eval Percent=((Accepted/total)*100)

and a few other combinations but none seemed to work.
Any help would be appreciated!

Re: eval values of a formula in a timechart command

somesoni2 — Thu, 23 Feb 2017 16:08:12 GMT

Give this a try

index="offers" STATUS="*" earliest=-7d@d 
| eval StartTime=relative_time(now(), "@d") 
| eval Series=case(
_time >=StartTime, "today",
_time <= relative_time(now(), "-6d@d"), "LastWk") 
| where isnotnull(Series)
| eval _time=if(Series="LastWk",_time+(86400*7),_time)
| bucket span=5m  _time
| chart count(STATUS) AS total, count(eval(STATUS="ACCEPTED")) AS Accepted by _time Series
| eval 'Percent: Today'=(('Accepted: Today'/'total: Today')*100)
| eval 'Percent: LastWk'=(('Accepted: LastWk'/'total: LastWk')*100)
| eval Time = strftime(_time, "%H:%M") | fields -_time
| table Time Percent* *

Re: eval values of a formula in a timechart command

mtrochym — Tue, 28 Feb 2017 00:37:13 GMT

Hmm. I think I see where you're going with this but I tried this and unfortunately it did not work. The search took about 45min to run and didn't return any results.

Re: eval values of a formula in a timechart command

jamojamil — Tue, 28 Feb 2017 01:17:36 GMT

yesssss great