topic Re: timechart question in Splunk Search

timechart question

dbautist — Mon, 07 Jan 2013 03:09:33 GMT

In the timechart docs, the following example was provided:

sourcetype=access_* | timechart count(eval(method="GET")) AS GET, count(eval(method="POST")) AS POST

What if I want to calculate the GetPercentage such that

eval GetPercentage=(GET/(GET+SUCCESS) * 100)

and have that displayed in the timechart? The result should be something like:

_time GetPercentage
1/6/2013 34.5
1/7/2013 22.5

Re: timechart question

Ayn — Mon, 07 Jan 2013 08:41:03 GMT

You can do this by adding your eval after the timechart command.

sourcetype=access_* | timechart count(eval(method="GET")) AS GET, count(eval(method="POST")) AS POST | eval GetPercentage=(GET/(GET+SUCCESS) * 100)

Re: timechart question

dbautist — Mon, 07 Jan 2013 16:19:00 GMT

Thanks! I also want to get a timechart of the GetPercentage by API. I don't want the GET or POST to show because I want to later create a line chart with just the GetPercentage by API. I started with the following but I can't insert the 'by API' in the eval clause:

sourcetype=access_* | timechart count(eval(method="GET")) AS GET, count(eval(method="POST")) AS POST | eval GetPercentage=(GET/(GET+SUCCESS) * 100) | fields - GET, POST

Expected output is something like:
_time getCustomerName(GetPercentage) getCustomerAge(GetPercentage)
1/6/2013 34.5 22.9
1/7/2013 22.5 33.7