https://community.splunk.com/t5/Splunk-Search/Displaying-calculated-value-in-timechart/m-p/180833#M52105 <P>My search sting is like:</P> <P>host=A|rename "ERC" TO EMPLOYERCODE|join EMPLOYERCODE [search host= B|rename EMPLOYER_CODE TO EMPLOYERCODE ]|timechart span=1d sum(Visits) AS Visit, count(USER_NAME) AS User by EMPLOYERCODE| eval avg=Visit/User|table _time,avg.</P> <P>My purpose is to generate a timechart with avg in y axis.<BR /> I am unable to display the avg in timechart. I am getting blank in average when using the above.Can you help me.</P> Mon, 28 Sep 2020 16:05:15 GMT jimjohn 2020-09-28T16:05:15Z https://community.splunk.com/t5/Splunk-Search/Displaying-calculated-value-in-timechart/m-p/180833#M52105 <P>My search sting is like:</P> <P>host=A|rename "ERC" TO EMPLOYERCODE|join EMPLOYERCODE [search host= B|rename EMPLOYER_CODE TO EMPLOYERCODE ]|timechart span=1d sum(Visits) AS Visit, count(USER_NAME) AS User by EMPLOYERCODE| eval avg=Visit/User|table _time,avg.</P> <P>My purpose is to generate a timechart with avg in y axis.<BR /> I am unable to display the avg in timechart. I am getting blank in average when using the above.Can you help me.</P> Mon, 28 Sep 2020 16:05:15 GMT https://community.splunk.com/t5/Splunk-Search/Displaying-calculated-value-in-timechart/m-p/180833#M52105 jimjohn 2020-09-28T16:05:15Z https://community.splunk.com/t5/Splunk-Search/Displaying-calculated-value-in-timechart/m-p/180834#M52106 <P>The <CODE>table</CODE> call at the end is weird. Let's convert this to a simple, run-anywhere example:</P> <PRE><CODE>index=_internal | timechart bins=20 sum(bytes) as Visit count(user) as User | eval avg = Visit/User | fields - Visit User </CODE></PRE> <P>This works for me, fills the column <CODE>avg</CODE> and removes the other two columns.</P> Tue, 11 Mar 2014 08:12:16 GMT https://community.splunk.com/t5/Splunk-Search/Displaying-calculated-value-in-timechart/m-p/180834#M52106 martin_mueller 2014-03-11T08:12:16Z https://community.splunk.com/t5/Splunk-Search/Displaying-calculated-value-in-timechart/m-p/180835#M52107 <P>The solution woks fine if we doesn't use by EMPLOYERCODE.<BR /> I need the result of sum and visits grouped by EMPLOYERCODE.</P> Tue, 11 Mar 2014 09:09:17 GMT https://community.splunk.com/t5/Splunk-Search/Displaying-calculated-value-in-timechart/m-p/180835#M52107 jimjohn 2014-03-11T09:09:17Z https://community.splunk.com/t5/Splunk-Search/Displaying-calculated-value-in-timechart/m-p/180836#M52108 <P>Ah, I missed that. In that case you don't have fields called avg and User but rather (I guess) <CODE>some_employer: avg</CODE> and <CODE>some_employer: User</CODE>. If that's the case, foreach is your friend - exact syntax depends on what fieldnames you have after the timechart.</P> Tue, 11 Mar 2014 10:16:02 GMT https://community.splunk.com/t5/Splunk-Search/Displaying-calculated-value-in-timechart/m-p/180836#M52108 martin_mueller 2014-03-11T10:16:02Z https://community.splunk.com/t5/Splunk-Search/Displaying-calculated-value-in-timechart/m-p/180837#M52109 <P>Thanks ,Let me try for each.</P> Tue, 11 Mar 2014 12:28:41 GMT https://community.splunk.com/t5/Splunk-Search/Displaying-calculated-value-in-timechart/m-p/180837#M52109 jimjohn 2014-03-11T12:28:41Z https://community.splunk.com/t5/Splunk-Search/Displaying-calculated-value-in-timechart/m-p/180838#M52110 <P>foreach solved my problem.</P> Wed, 12 Mar 2014 09:34:06 GMT https://community.splunk.com/t5/Splunk-Search/Displaying-calculated-value-in-timechart/m-p/180838#M52110 jimjohn 2014-03-12T09:34:06Z