topic Re: How can I use results of a stats table to output to another pipe or timechart? in Splunk Search

How can I use results of a stats table to output to another pipe or timechart?

spark2310 — Fri, 08 Dec 2017 20:13:49 GMT

I am using this query. output basically will return error codes sorted with high percentage difference (errors are increasing). I am using fields command to only output top 10 errors in table

since this query will show as stats table, how can I use this output to further pipe or do a timechart?

Re: How can I use results of a stats table to output to another pipe or timechart?

somesoni2 — Fri, 08 Dec 2017 21:32:27 GMT

What's your final expected output (that you want to generate for these top 10 error codes)?

Re: How can I use results of a stats table to output to another pipe or timechart?

spark2310 — Fri, 08 Dec 2017 22:02:13 GMT

Final output should be a timechart of the top 10 error codes (of query I posted above)

Re: How can I use results of a stats table to output to another pipe or timechart?

somesoni2 — Fri, 08 Dec 2017 22:10:51 GMT

If your timechart query's timerange is different from last 2 hr, then try like this

index=source [search index=source earliest=-2h sourcetype=e | bucket _time span=1h |stats count by code _time| delta count as difference | eval percdif=round(abs(difference/count)*100,0)|table code, count, difference, percdif|sort -percdif -count|where count>1100|fields code|head 10] 
| timechart count by code

Re: How can I use results of a stats table to output to another pipe or timechart?

spark2310 — Fri, 08 Dec 2017 22:36:44 GMT

It did not work, returns 0 results

Re: How can I use results of a stats table to output to another pipe or timechart?

somesoni2 — Fri, 08 Dec 2017 22:47:26 GMT

How about this

index=source sourcetype=e  [search index=source earliest=-2h sourcetype=e | bucket _time span=1h |stats count by code _time| delta count as difference | eval percdif=round(abs(difference/count)*100,0)|table code, count, difference, percdif|sort -percdif -count|where count>1100|fields code|head 10] 
 | timechart count by code

Re: How can I use results of a stats table to output to another pipe or timechart?

spark2310 — Fri, 08 Dec 2017 23:00:27 GMT

Thanks working now

Re: How can I use results of a stats table to output to another pipe or timechart?

spark2310 — Fri, 08 Dec 2017 23:16:17 GMT

does this work if I pass more than one field (code and percdif) to timechart as well?

Re: How can I use results of a stats table to output to another pipe or timechart?

somesoni2 — Sat, 09 Dec 2017 00:20:45 GMT

It'll. As long as that field is present in main search.