topic timechart , streanstats Question in Splunk Search

timechart , streanstats Question

qfjp — Mon, 30 Sep 2013 02:02:09 GMT

sourcetype=syslog | timechart span=1m count by Protocol | streamstats sum() avg()

The result of this query is as follows:
(Time fields have been omitted.)

17  2  6   avg(17)  avg(2)  avg(6)   sum(17)  sum(2)  sum(6)  
4   0  30  4.0000   0.0000  30.0000  4        0       30       
14  1  103 9.0000   0.5000  66.5000  18       1       133      
21  0  5   13.000   0.3333  46.0000  39       1       138      
22  1  0   15.250   0.5000  34.5000  61       2       138    
20  0  12  16.200   0.4000  30.0000  81       2       150      
11  1  32  15.333   0.5000  30.3333  92       3       182    


sourcetype=syslog | timechart span=1m count by Protocol 
| streamstats sum() avg()
| eval S/A=sum+avg

The results of this query as the table below and are stoked.
However, the results of the query does not appear.

17  2  6   avg(17)  avg(2)  avg(6)   sum(17)  sum(2)  sum(6)  S/A(17)  S/A(2)  S/A(6) 
4   0  30  4.0000   0.0000  30.0000  4        0       30      ?        ?       ?
14  1  103 9.0000   0.5000  66.5000  18       1       133     ?        ?       ?
21  0  5   13.000   0.3333  46.0000  39       1       138     ?        ?       ?
22  1  0   15.250   0.5000  34.5000  61       2       138     ?        ?       ?
20  0  12  16.200   0.4000  30.0000  81       2       150     ?        ?       ?
11  1  32  15.333   0.5000  30.3333  92       3       182     ?        ?       ?

How do you create a query?

Re: timechart , streanstats Question

yannK — Mon, 30 Sep 2013 03:28:59 GMT

can you clarify that is your goal ?

also S/A may not be a valid field name, try "S/A"

Re: timechart , streanstats Question

kristian_kolb — Mon, 30 Sep 2013 05:58:12 GMT

or "s_a". From the documentation;

Valid characters for field names are a-z, A-Z, 0-9, or _ .
Field names cannot begin with 0-9 or _ . Leading underscores are reserved for Splunk's internal variables.
International characters are not allowed.

Re: timechart , streanstats Question

alacercogitatus — Mon, 30 Sep 2013 18:56:11 GMT

Do what kkolb says. Fieldnames can't be "S/A", it needs to be s_a.