https://community.splunk.com/t5/Splunk-Search/How-to-divide-the-results-of-a-timechart-by-statement/m-p/599286#M208632 <P>With dynamic columns, you'd use foreach command. Like this:</P><LI-CODE lang="markup">index="murex_logs" | timechart span=1m count by mx.env | foreach * [| eval "&lt;&lt;FIELD&gt;&gt;"=round('&lt;&lt;FIELD&gt;&gt;'/60,2)]</LI-CODE><P>"&lt;&lt;FIELD&gt;&gt;" is a literal string to be used as-is. See more information on foreach command here:&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Foreach" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Foreach</A></P> Wed, 25 May 2022 12:59:26 GMT somesoni2 2022-05-25T12:59:26Z https://community.splunk.com/t5/Splunk-Search/How-to-divide-the-results-of-a-timechart-by-statement/m-p/599250#M208614 <P>Hi</P> <P>I have a basic statement, however, I want the answers to be in per second. So I need to provide all the results by 60, however, as I am using the <STRONG>by</STRONG> command I cant do something like eval count = count/60. As all the columns are different - I might be able to use a for - but this might affect _time. Any ideas? Am i missing something simple hear?</P> <P>&nbsp;</P> <LI-CODE lang="markup">index="murex_logs" | timechart span=1m count by mx.env</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="robertlynch2020_0-1653475015949.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/19814iC6AD429398F28C3F/image-size/medium?v=v2&amp;px=400" role="button" title="robertlynch2020_0-1653475015949.png" alt="robertlynch2020_0-1653475015949.png" /></span></P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> Wed, 25 May 2022 18:24:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-divide-the-results-of-a-timechart-by-statement/m-p/599250#M208614 robertlynch2020 2022-05-25T18:24:41Z https://community.splunk.com/t5/Splunk-Search/How-to-divide-the-results-of-a-timechart-by-statement/m-p/599252#M208616 <LI-CODE lang="markup">index="murex_logs" | bucket span=1min _time | stats count by mx.enc _time</LI-CODE> Wed, 25 May 2022 10:42:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-divide-the-results-of-a-timechart-by-statement/m-p/599252#M208616 Software-Simian 2022-05-25T10:42:13Z https://community.splunk.com/t5/Splunk-Search/How-to-divide-the-results-of-a-timechart-by-statement/m-p/599286#M208632 <P>With dynamic columns, you'd use foreach command. Like this:</P><LI-CODE lang="markup">index="murex_logs" | timechart span=1m count by mx.env | foreach * [| eval "&lt;&lt;FIELD&gt;&gt;"=round('&lt;&lt;FIELD&gt;&gt;'/60,2)]</LI-CODE><P>"&lt;&lt;FIELD&gt;&gt;" is a literal string to be used as-is. See more information on foreach command here:&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Foreach" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Foreach</A></P> Wed, 25 May 2022 12:59:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-divide-the-results-of-a-timechart-by-statement/m-p/599286#M208632 somesoni2 2022-05-25T12:59:26Z