Dashboards & Visualizations

How to convert from timechart to column chart with totals?

mcram52
New Member

I'm new to Splunk (and programming languages in general) but my company has many existing dashboards, so I'm trying to take pieces of existing dashboards and tweak them for my purposes. I have the following search from an existing chart:

(index=epackage OR index=dxprd01-epackage) flow_event=Package*
| eval 
    You = if(username="$env:user$",numberOfReports,0),
    Others = if(username="$env:user$",0,numberOfReports),
    Other_users = if(username="$env:user$",null(),username),
    Day = strftime(_time,"%F")
| eventstats dc(Other_users) as Other_users by Day
| timechart span=1d sum(You) as You sum(Others) as Others values(Other_users) as Other_users
| eval Others_avg = round(Others/Other_users,0)
| fields - Others, Other_users

This displays the total of one user's flow event per day compared with the average of the other users for that day. What changes need to be made so I can have the same two columns (single user vs. others average), but showing only the totals over the given time period (such as month to date) rather than by day? Hopefully this makes sense.

0 Karma
1 Solution

somesoni2
Revered Legend

Try this (Updated)

(index=epackage OR index=dxprd01-epackage) flow_event=Package*
| eval 
You = if(username="$env:user$",numberOfReports,0),
Others = if(username="$env:user$",0,numberOfReports),
Other_users = if(username="$env:user$",null(),username),
Report="Total Flow Event Count"
|stats sum(You) as You sum(Others) as Others dc(Other_users) as Other_users by Report
| eval Others_avg = round(Others/Other_users,0)
| fields - Others, Other_users

View solution in original post

0 Karma

somesoni2
Revered Legend

Try this (Updated)

(index=epackage OR index=dxprd01-epackage) flow_event=Package*
| eval 
You = if(username="$env:user$",numberOfReports,0),
Others = if(username="$env:user$",0,numberOfReports),
Other_users = if(username="$env:user$",null(),username),
Report="Total Flow Event Count"
|stats sum(You) as You sum(Others) as Others dc(Other_users) as Other_users by Report
| eval Others_avg = round(Others/Other_users,0)
| fields - Others, Other_users
0 Karma

mcram52
New Member

No luck:

Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression.

0 Karma

somesoni2
Revered Legend

Try now, there was leftover comma in last eval (line 5).

0 Karma

mcram52
New Member

That's getting closer to what I wanted but not quite. Everything is totaled as it should be, but the total for 'You' is now the entire x axis, with one column showing the 'Others_avg' total. Is there a way to have the 'You' and 'Other_avg' displayed as two separate columns?

0 Karma

somesoni2
Revered Legend

Try the new version.

0 Karma

mcram52
New Member

Almost there! Thank you so much for working with me on this. There's two separate columns now but one is on top of the other (not stacked, but separated). Any way the columns can be placed side by side? It almost looks like the x and y axis need to be switched if that's possible.

0 Karma

mcram52
New Member

Nevermind, figured it out. Thanks!

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...