Splunk Search

how to divide two fields in a search and print the result values in timechart

sawgata12345
Path Finder

alt textHi,

suppose a query is like: index="demo1" total_bytes,total_time,date etc
I need to divide total_bytes/total_time from each record and show the value in timechart.

index="demo1" |eval result = total_bytes / total_time | timechart result

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

you can try something like this

index="demo1" |eval result = total_bytes / total_time | timechart span=1h values(result)

specify span accordingly you can specify anything I have specified as 1 hour
Using this query you might get multiple results for one timestamp as there can be multiple results within that time period.

If you want to sum all the time for that time period you can use

index="demo1" |eval result=total_bytes / total_time | timechart span=1h sum(result)

let me know if this helps!

View solution in original post

0 Karma

erikgrasman
Engager

index="demo1" sourcetype="demo1"
| timechart eval(avg(total_bytes)/avg(total_time)) as result

As the error states you need to use a function in your timechart (like avg or max)

0 Karma

mayurr98
Super Champion

you can try something like this

index="demo1" |eval result = total_bytes / total_time | timechart span=1h values(result)

specify span accordingly you can specify anything I have specified as 1 hour
Using this query you might get multiple results for one timestamp as there can be multiple results within that time period.

If you want to sum all the time for that time period you can use

index="demo1" |eval result=total_bytes / total_time | timechart span=1h sum(result)

let me know if this helps!

0 Karma

sawgata12345
Path Finder

Hi,
ya it helped a bit.
I used
index="demo1" earliest=-7d@w1 latest=@w6 |eval res= total_write_io_bytes/total_write_io_count |timechart values(res)

its actually adding all the res for one day and showing single. for the past week each day value is showing as total of the day.
https://unsee.cc/c8d8030b/

I need it per record basis as and when data comes in, for each record evaluate the value of total_write_io_bytes/total_write_io_count and show in time series as continuous basis.
(after each 10 sec data is coming in, so it should show multiple records in timechart for a single day itself)

0 Karma

mayurr98
Super Champion

|timechart values(res) will not add up. this command will give you all the results in that time period.
If you want per event basis time then you can do something like this.

index="demo1" earliest=-7d@w1 latest=@w6 |eval res= total_write_io_bytes/total_write_io_count | bin _time span=1d |  eval _time=strftime(_time,"%Y-%m-%d") | chart count over res by _time

OR

index="demo1" earliest=-7d@w1 latest=@w6 |eval res= total_write_io_bytes/total_write_io_count | timechart count by res

let me know if this helps!

0 Karma

sawgata12345
Path Finder

thanks
it works

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...