topic Re: Timechart Table Question in Splunk Search

Timechart Table Question

jhayIV — Thu, 05 Jan 2017 18:02:18 GMT

Is there a way to add a column to the table below that divides each value by the IS&O to value to get a column that shows compliance?

Example for Tuesday I would like to have a column that divides System Role by IS&O Servers 10046/11683, 86%

Also is there a way to remove the _span entries at the bottom?

Re: Timechart Table Question

jhayIV — Tue, 29 Sep 2020 12:16:21 GMT

It didnt allow me to post an image here is the code I was using

| timechart span=1d dc(Name) as "IS&O Servers" , Count(SystemRole) as "System Role", count(IsVirtual) as "Virtual Flag", count(OS) as "OS Relationships",count(Site) as "Location",count(Serial_Number) as "Serial Number",count(Domain) as "Domain",count(NumberOfProcessors) as "Processors",count(Total_Physical_Memory) as "Memory"| eval _time=strftime(_time, "%A")| transpose

Re: Timechart Table Question

cmerriman — Thu, 05 Jan 2017 19:05:37 GMT

are you doing just a 7 day span for your search? I'm just thinking if you do 2 weeks, it isn't going to combine your Thursdays together in the transpose.

Re: Timechart Table Question

cmerriman — Thu, 05 Jan 2017 19:13:49 GMT

as long as you're only looking at a 7 day time window, try this:

| timechart span=1d dc(Name) as "IS&O Servers" , Count(SystemRole) as "System Role", count(IsVirtual) as "Virtual Flag", count(OS) as "OS Relationships",count(Site) as "Location",count(Serial_Number) as "Serial Number",count(Domain) as "Domain",count(NumberOfProcessors) as "Processors",count(Total_Physical_Memory) as "Memory"| eval _time=strftime(_time, "%A")|fields - _span*|foreach * [eval <<MATCHSTR>>_perc='<<FIELD>>'/'IS&O Servers']|fields - "IS&O Servers_perc"| transpose header_field=_time

Re: Timechart Table Question

jhayIV — Thu, 05 Jan 2017 19:37:11 GMT

That is perfect, is there a way to do it as a column for each date? This appended the perc's to the bottom of the table.

Re: Timechart Table Question

cmerriman — Thu, 05 Jan 2017 19:53:03 GMT

This took a bit of thought but I think it should work.

| timechart span=1d dc(Name) as "IS&O Servers" , Count(SystemRole) as "System Role", count(IsVirtual) as "Virtual Flag", count(OS) as "OS Relationships",count(Site) as "Location",count(Serial_Number) as "Serial Number",count(Domain) as "Domain",count(NumberOfProcessors) as "Processors",count(Total_Physical_Memory) as "Memory"| eval _time=strftime(_time, "%A")|fields - _span*|foreach * [eval <<MATCHSTR>>_perc='<<FIELD>>'/'IS&O Servers']|fields - "IS&O Servers_perc"|appendpipe [stats values(*_perc) as * by _time]|eval _time=if(isnull('IS&O Servers'),_time+"_perc",_time)|fields - *_perc| transpose 14 header_field=_time

Re: Timechart Table Question

jhayIV — Thu, 05 Jan 2017 20:12:38 GMT

Impressive, thanks man!

Re: Timechart Table Question

aaraneta_splunk — Wed, 11 Jan 2017 00:37:04 GMT

@jhayIV - If cmerriman helped to answer your question, please accept her answer and up-vote any helpful comments from her. Thanks!