topic Re: Variable storage in Splunk Search

Variable storage

Kendrick33 — Tue, 23 Nov 2010 05:36:31 GMT

I am performing some math functions in splunk.I am doing a search that will calculate the percentage of each data type. What variable can I use to store values without them having to be charted until the end of my search.

For example:

chart avg(db_abc_p) as anr, avg(db_efg) as enr, avg(db_hij) as hnr, avg(db_total) as Total | eval percentANR=(anr/Total)*100 | eval percentENR (enr/Total)*100 | eval percentHNR=hnr/Total)*100

what I end up with is valueS outputed for all seven variables, when all I really want is to display the values for : percentANR, percentENR, percentHNR

Re: Variable storage

southeringtonp — Tue, 23 Nov 2010 06:45:27 GMT

Use the fields command to limit the display to just those you want to keep:

| fields percentANR, percentENR, percentHNR

Re: Variable storage

gkanapathy — Tue, 23 Nov 2010 07:00:10 GMT

Or ... | fields - unwantedfield to remove specific fields.

Re: Variable storage

sfleming — Tue, 23 Nov 2010 08:57:50 GMT

or... for a simple table display,

... | table percentANR, percentENR, percentHNR

The table command will output the columns in the order you specify.