topic Re: TimeChart assigning values from Spanned table in Splunk Search

Why is TimeChart assigning values from spanned table?

michaelhaedt — Tue, 05 Apr 2022 16:55:23 GMT

Hello All,

I have a really simple search, while it works, I'd like to do some operations on that data:

index=xxxx earliest=-2w@w0 latest=@w6@d+24h | timechart span=7d count(response_time)

Output is

2022-03-13 3,xxx,xxx

2022-03-20 3,xxx.xxx

The deal is, I'd really like to have those seperate outputs as variables like Week1 and Week2. This way I could do some operations to see my sites volume week to week change so I can normalize error data. Hopefully this makes sense.

Re: TimeChart assigning values from Spanned table

VatsalJagani — Sat, 02 Apr 2022 06:15:45 GMT

Try this:

index=xxx earliest=-2w@w0 latest=@w6@d+24h | timechart span=7d count(response_time) | streamstats count as week_num | eval Week="Week ".week_num | fields - week_num, _time

Kindly accept the answer if it gives resolution.

Re: TimeChart assigning values from Spanned table

michaelhaedt — Tue, 05 Apr 2022 14:58:56 GMT

So that gives me a very similar output to what I have, which I need to have variables assigned the count(response_time) of each of the weeks. I like how this solution put it into one search and not an appended search though, very clever, I'd love to know how it works.

Re: TimeChart assigning values from Spanned table

VatsalJagani — Tue, 05 Apr 2022 15:58:49 GMT

With streamstats you can assign the numbers to your results and then with eval I'm just appending that number to "Week ".

This works because proper ordering and missing values of _time series will already be handled by timechart command.

Re: TimeChart assigning values from Spanned table

michaelhaedt — Tue, 05 Apr 2022 16:05:20 GMT

Thanks for the explanation! I still need a way to assign the counts of Week 1 and 2 to variables so I can start to manipulate the data.

Re: TimeChart assigning values from Spanned table

VatsalJagani — Tue, 05 Apr 2022 16:51:59 GMT

Can you please explain by posting your current output and explain what change you are looking for?

Re: TimeChart assigning values from Spanned table

michaelhaedt — Tue, 05 Apr 2022 17:19:47 GMT

Below is my data: I need to be able to assign the data to a variable like Week1Data = 1160516 and Week2Data = 3488119

This seems really easy, but I don't know how to logically address the data in the table to do an Eval

1	1160516	Week 1
2	3488119	Week 2

Re: TimeChart assigning values from Spanned table

VatsalJagani — Tue, 05 Apr 2022 17:58:17 GMT

Try this query:

transpose command should be able to do what you are looking for.