topic Re: Question on basic subtraction in time charts in Splunk Search

Question on basic subtraction in time charts

clintla — Mon, 28 Sep 2020 09:42:52 GMT

Per below- my Total Configured_Space & Free_Space work great.

timechart eval(sum(Logical_Capacity_Blocks) / 2097152000) as Configured_Space,eval(sum(Free_contiguous_group_of_unbound_segments) / 2097152000) as Free_Space, eval(Configured_Space - Free_Space)

Now I'd like to have a listing of consumed space in my chart which means I really need
to subtract Free_Space from Configured_Space & I've tried several variations which
dont really work.
keep getting

Error in 'timechart' command: The eval expression has no fields: 'WDC_Configured_Space - Free_Space'

I've found the doc's page & it never really comes out & says how to subtract.
http://www.splunk.com/base/Documentation/4.2.1/SearchReference/Eval

What is the correct syntax to do subtraction?

Re: Question on basic subtraction in time charts

MuS — Mon, 04 Jul 2011 06:32:49 GMT

Hi clintla

have you tried the following eval?

eval consumed_space = Configured_Space - Free_Space

regrads

Re: Question on basic subtraction in time charts

clintla — Tue, 05 Jul 2011 16:32:12 GMT

I think so. Get this error

Error in 'timechart' command: The specifier 'eval' is invalid. It must be in form (). For example: max(size).

Re: Question on basic subtraction in time charts

MuS — Wed, 06 Jul 2011 04:54:16 GMT

Hi Clintla

well I can fire up your command like this:

* | timechart eval(sum(Logical_Capacity_Blocks_) / 2097152000) as Configured_Space, eval(sum(Free_contiguous_group_of_unbound_segments) / 2097152000) as Free_Space | eval consumed_space = Configured_Space - Free_Space

it runs without any error and brings up an result.

cheers

Re: Question on basic subtraction in time charts

clintla — Mon, 28 Sep 2020 09:43:12 GMT

Thanks, That works... I feel like I got what I asked for & not what I wanted. I used a , instead of a pipe.

Not really sure why there is not more documentation on
Do's & donts.

I'd like to have a graph of used/free space but the above
throws in total space which messes up the graph.

try things like
source="OSDC" | timechart eval(sum(Free_contiguous_group_of_unbound_segments) / 2097152000) as Free_Space | eval Consumed_space = eval(sum(Logical_Capacity_Blocks) / 2097152000) - Free_Space

& it tells me SUM is not supported. puzzling.

other tries- says no fields.

I'll try some more.

Re: Question on basic subtraction in time charts

splunkpoornima — Tue, 16 Oct 2012 10:39:01 GMT

hi i also got the same error