https://community.splunk.com/t5/Splunk-Search/How-to-take-the-result-from-a-timechart-sum-by-and-multiply-it/m-p/630514#M219058 <P>Try this.&nbsp; It cycles through each report class and uses <FONT face="courier new,courier">eval</FONT> to compute the MSUs used.</P><LI-CODE lang="markup">index=z* MFSOURCETYPE=SMF030 Subtype=2 `calccpusecs` | where Rptcls IN("RHOTBAT","RPDBATLO","RPDBATMD","RSAGBAT","RTSTBAT") | eval MSUFactor=(37209.3023/5/216000) | timechart span=1d sum(cpusecs) by Rptcls | foreach RHOTBAT RPDBATLO RPDBATMD RSAGBAT RTSTBAT [ eval &lt;&lt;FIELD&gt;&gt;_MSUs=&lt;&lt;FIELD&gt;&gt; * MSUFactor ] | addcoltotals</LI-CODE><P>&nbsp; Note that <FONT face="courier new,courier">&lt;&lt;FIELD&gt;&gt;</FONT> is literal, not a placeholder.&nbsp;</P> Fri, 10 Feb 2023 20:16:47 GMT richgalloway 2023-02-10T20:16:47Z https://community.splunk.com/t5/Splunk-Search/How-to-take-the-result-from-a-timechart-sum-by-and-multiply-it/m-p/630505#M219056 <P>Hello, what I am trying to do in this search is sum the total CPU seconds, by report class, for a one day period. Once I have that sum, I would like to take it one step further and multiply that sum by our MSU factor to determine the MSUs used by a specific report class for any given day.&nbsp;</P><P>I believe what I need to do is store the result from the timechart statement as a new variable, to be able to multiply that variable by the MSUFactor. I have not had any luck in&nbsp; trying a combination of 'eval' statements or by leveraging the AS keyword to store the result into a variable I can further work with.&nbsp;</P><P>I appreciate any help you may be able to offer!</P><P>index=z* MFSOURCETYPE=SMF030 Subtype=2 `calccpusecs`<BR />| where Rptcls IN("RHOTBAT","RPDBATLO","RPDBATMD","RSAGBAT","RTSTBAT")<BR />| eval MSUFactor=(37209.3023/5/216000)<BR />| timechart span=1d sum(cpusecs) by Rptcls<BR />| addcoltotals</P> Fri, 10 Feb 2023 19:04:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-take-the-result-from-a-timechart-sum-by-and-multiply-it/m-p/630505#M219056 jhewel2495 2023-02-10T19:04:40Z https://community.splunk.com/t5/Splunk-Search/How-to-take-the-result-from-a-timechart-sum-by-and-multiply-it/m-p/630514#M219058 <P>Try this.&nbsp; It cycles through each report class and uses <FONT face="courier new,courier">eval</FONT> to compute the MSUs used.</P><LI-CODE lang="markup">index=z* MFSOURCETYPE=SMF030 Subtype=2 `calccpusecs` | where Rptcls IN("RHOTBAT","RPDBATLO","RPDBATMD","RSAGBAT","RTSTBAT") | eval MSUFactor=(37209.3023/5/216000) | timechart span=1d sum(cpusecs) by Rptcls | foreach RHOTBAT RPDBATLO RPDBATMD RSAGBAT RTSTBAT [ eval &lt;&lt;FIELD&gt;&gt;_MSUs=&lt;&lt;FIELD&gt;&gt; * MSUFactor ] | addcoltotals</LI-CODE><P>&nbsp; Note that <FONT face="courier new,courier">&lt;&lt;FIELD&gt;&gt;</FONT> is literal, not a placeholder.&nbsp;</P> Fri, 10 Feb 2023 20:16:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-take-the-result-from-a-timechart-sum-by-and-multiply-it/m-p/630514#M219058 richgalloway 2023-02-10T20:16:47Z