https://community.splunk.com/t5/Splunk-Search/How-to-develop-a-timechart-by-host-with-eval-command/m-p/215927#M63331 <P>Thanks! it works!</P> Wed, 28 Sep 2016 19:54:12 GMT kualo 2016-09-28T19:54:12Z https://community.splunk.com/t5/Splunk-Search/How-to-develop-a-timechart-by-host-with-eval-command/m-p/215925#M63329 <P>Hi,</P> <P>I have the below search to find the SLA of my application <STRONG>by host</STRONG> in the specific time span.<BR /> But I don't know why it won't show up SLA</P> <PRE><CODE>some search | timechart span=30m count as VOLUME count(eval(respTime&lt;=10)) as COUNT by host | eval SLA=COUNT/VOLUME*100 </CODE></PRE> <P>I want to show SLA and VOLUME together in the line graph so I tried below but it didn't work</P> <PRE><CODE>some search | timechart span=30m count as VOLUME count(eval(respTime&lt;=10)) as COUNT by host | eval SLA=COUNT/VOLUME*100 | fields + _time VOLUME SLA </CODE></PRE> <P>Can someone help? Thanks!</P> Wed, 28 Sep 2016 15:54:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-develop-a-timechart-by-host-with-eval-command/m-p/215925#M63329 kualo 2016-09-28T15:54:20Z https://community.splunk.com/t5/Splunk-Search/How-to-develop-a-timechart-by-host-with-eval-command/m-p/215926#M63330 <P>The problem here is that when you use the timechart ( or chart command) with a by clause, the field name that you're going to see will be <CODE>_time</CODE> and <CODE>VOLUME: host1</CODE>, <CODE>VOLUME: host2</CODE>.... and <CODE>COUNT: host1</CODE>, <CODE>COUNT: host2</CODE>.... So when you're doing a SLA calculation, the field that you refer (plain COUNT and VOLUME) doesn't exist and hence it's not shown in the graph. In fact, if you check the legend of your line chart, you can see the name of the series will be similar to what I mentioned earlier. </P> <P>If you want to show to total VOLUME and SLA for each host in a timechart, try like this.</P> <PRE><CODE>some search | bucket span=30m _time | stats count as VOLUME count(eval(respTime&lt;=10)) as COUNT by _time host | eval SLA=COUNT*100/VOLUME | timechart values(VOLUME) as VOLUME values(SLA) as SLA by host </CODE></PRE> <P>Again, as mentioned earlier, you'd get fields like <CODE>_time VOLUME:host1 VOLUME:host2... SLA:host1 SLA:host2...</CODE></P> Wed, 28 Sep 2016 17:47:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-develop-a-timechart-by-host-with-eval-command/m-p/215926#M63330 somesoni2 2016-09-28T17:47:06Z https://community.splunk.com/t5/Splunk-Search/How-to-develop-a-timechart-by-host-with-eval-command/m-p/215927#M63331 <P>Thanks! it works!</P> Wed, 28 Sep 2016 19:54:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-develop-a-timechart-by-host-with-eval-command/m-p/215927#M63331 kualo 2016-09-28T19:54:12Z https://community.splunk.com/t5/Splunk-Search/How-to-develop-a-timechart-by-host-with-eval-command/m-p/215928#M63332 <P>This is exactly what I was looking for! Now, to what I believe is the easy part, I wanted to add a constant red line, indicating the SLA limit. I tried placing <CODE>eval sla=99</CODE> , but it never shows.</P> Sun, 02 Oct 2016 05:55:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-develop-a-timechart-by-host-with-eval-command/m-p/215928#M63332 badamastor 2016-10-02T05:55:53Z