Solved: need to get a input for reports - Page 2

splunkuseradmin · ‎07-19-2019

hi all
below is my query i am working with i have a correct output of business hours utilization using formula but i have to input manually in the formula is there a way i can do it using any input for selected timeperiod so i dont have to do it manual.
ex., I used | eval ... , which is correct but used540as total minutes forbusiness hoursfor the time periodyesterday. but i need a input so if i select any othertimeperiodi get utilization value not by entering540foryesterdayor2700total minutes(business hours) forlast week`.

woodcock · ‎07-19-2019

Like this:

... | eval utilization=round(100*minutes/
[|makeresults 
| addinfo 
| eval _time = info_min_time 
| timechart count span=1h
| eval dayofweek = strftime(_time, "%a") 
| eval hourofday = strftime(_time, "%H")
| search (NOT (dayofweek="Sat" OR dayofweek="Sun")) AND hourofday>7 AND hourofday<17
| stats count AS business_hours
| eval business_minutes = 60 * business_hours], 2). "%" ...

View solution in original post

need to get a input for reports

Extending Observability Content to Splunk Cloud

More Control Over Your Monitoring Costs with Archived Metrics!

New in Observability Cloud - Explicit Bucket Histograms