https://community.splunk.com/t5/Splunk-Search/Apply-a-factor-to-count-in-timechart/m-p/142901#M39690 <P>Hi. </P> <P>I'm triying to correlate in a time chart number of visits with average response time but time is in milisecons and visits in thousands, so y want to aply a factor to count thousands instead of visits, but seems I can not apply directly to a count. I also tried to eval it previously but still getting invalid command.</P> <P>so how do I apply a factor to a count in order to reduce its magnitude for a timechart? I'm using splunkstorm</P> Sat, 08 Feb 2014 08:59:18 GMT splunkprimeriti 2014-02-08T08:59:18Z https://community.splunk.com/t5/Splunk-Search/Apply-a-factor-to-count-in-timechart/m-p/142901#M39690 <P>Hi. </P> <P>I'm triying to correlate in a time chart number of visits with average response time but time is in milisecons and visits in thousands, so y want to aply a factor to count thousands instead of visits, but seems I can not apply directly to a count. I also tried to eval it previously but still getting invalid command.</P> <P>so how do I apply a factor to a count in order to reduce its magnitude for a timechart? I'm using splunkstorm</P> Sat, 08 Feb 2014 08:59:18 GMT https://community.splunk.com/t5/Splunk-Search/Apply-a-factor-to-count-in-timechart/m-p/142901#M39690 splunkprimeriti 2014-02-08T08:59:18Z https://community.splunk.com/t5/Splunk-Search/Apply-a-factor-to-count-in-timechart/m-p/142902#M39691 <P>How did you try eval? That's probably how you would achieve this.</P> Sat, 08 Feb 2014 10:19:49 GMT https://community.splunk.com/t5/Splunk-Search/Apply-a-factor-to-count-in-timechart/m-p/142902#M39691 Ayn 2014-02-08T10:19:49Z https://community.splunk.com/t5/Splunk-Search/Apply-a-factor-to-count-in-timechart/m-p/142903#M39692 <P>Try this workaround. Assumming your original query is like this (giving count in 1000's and you want to apply a factor fct to reduce the magnitude of values.<BR /> Orig:</P> <PRE><CODE>index=XX sourcetype=YY | timechart span=NN count by somefield </CODE></PRE> <P>Updated:</P> <PRE><CODE>index=XX sourcetype=YY | bucket span=NN _time | stats count by somefield,_time | timechart sum(eval(count/fct)) as count by somefield | makecontinous _time span=NN </CODE></PRE> Sat, 08 Feb 2014 17:43:21 GMT https://community.splunk.com/t5/Splunk-Search/Apply-a-factor-to-count-in-timechart/m-p/142903#M39692 somesoni2 2014-02-08T17:43:21Z