topic Re: how to join two charts in Splunk Search

how to add calculated fields into a chart

chongdong — Thu, 20 Jan 2022 03:41:23 GMT

I am trying to add 2 new fields into a chart, which is calculated by the exisiting columns in the following chart. Basically I want to add A3=A2/A1, and B3=B2/B1:

Can anyone suggest which command to use?

Re: how to join two charts

bowesmana — Thu, 20 Jan 2022 03:40:58 GMT

Can you provide the query you are using? What happens when you tried what you tried?

Re: how to join two charts

chongdong — Thu, 20 Jan 2022 03:45:26 GMT

Just found I can directly add sum(___) and dc(___) inside chart command which solved my previous problem lol! Thanks for looking into it though. Now I have a follow up quesion about my post-analysis for adding calculated fileds into the same chart...

Re: how to join two charts

bowesmana — Thu, 20 Jan 2022 04:20:46 GMT

Try this - replace your last chart statement with these two lines - the chart just is renaming the fields and the foreach is doing the calc, i.e. Ratio=TintCount/Zones

| chart sum(tint_count) as TintCount dc(zonename) as Zones by direction type | foreach TintCount* [ eval "Ratio<<MATCHSTR>>"='<<FIELD>>'/'Zones<<MATCHSTR>>' ]

Re: how to join two charts

chongdong — Thu, 20 Jan 2022 06:35:25 GMT

Thanks for the suggestion! But it doesn't seem to work

Is the foreach command supposed to insert a new column called Ratio in this case?

Re: how to join two charts

ITWhisperer — Thu, 20 Jan 2022 07:12:50 GMT

dc(zonename) should be dc(zoneName)

Re: how to join two charts

bowesmana — Sun, 23 Jan 2022 23:24:47 GMT

Oops thanks @ITWhisperer pointing out the typo