Dashboards & Visualizations

How to convert from timechart to column chart with totals?

mcram52
New Member

I'm new to Splunk (and programming languages in general) but my company has many existing dashboards, so I'm trying to take pieces of existing dashboards and tweak them for my purposes. I have the following search from an existing chart:

(index=epackage OR index=dxprd01-epackage) flow_event=Package*
| eval 
    You = if(username="$env:user$",numberOfReports,0),
    Others = if(username="$env:user$",0,numberOfReports),
    Other_users = if(username="$env:user$",null(),username),
    Day = strftime(_time,"%F")
| eventstats dc(Other_users) as Other_users by Day
| timechart span=1d sum(You) as You sum(Others) as Others values(Other_users) as Other_users
| eval Others_avg = round(Others/Other_users,0)
| fields - Others, Other_users

This displays the total of one user's flow event per day compared with the average of the other users for that day. What changes need to be made so I can have the same two columns (single user vs. others average), but showing only the totals over the given time period (such as month to date) rather than by day? Hopefully this makes sense.

0 Karma
1 Solution

somesoni2
Revered Legend

Try this (Updated)

(index=epackage OR index=dxprd01-epackage) flow_event=Package*
| eval 
You = if(username="$env:user$",numberOfReports,0),
Others = if(username="$env:user$",0,numberOfReports),
Other_users = if(username="$env:user$",null(),username),
Report="Total Flow Event Count"
|stats sum(You) as You sum(Others) as Others dc(Other_users) as Other_users by Report
| eval Others_avg = round(Others/Other_users,0)
| fields - Others, Other_users

View solution in original post

0 Karma

somesoni2
Revered Legend

Try this (Updated)

(index=epackage OR index=dxprd01-epackage) flow_event=Package*
| eval 
You = if(username="$env:user$",numberOfReports,0),
Others = if(username="$env:user$",0,numberOfReports),
Other_users = if(username="$env:user$",null(),username),
Report="Total Flow Event Count"
|stats sum(You) as You sum(Others) as Others dc(Other_users) as Other_users by Report
| eval Others_avg = round(Others/Other_users,0)
| fields - Others, Other_users
0 Karma

mcram52
New Member

No luck:

Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression.

0 Karma

somesoni2
Revered Legend

Try now, there was leftover comma in last eval (line 5).

0 Karma

mcram52
New Member

That's getting closer to what I wanted but not quite. Everything is totaled as it should be, but the total for 'You' is now the entire x axis, with one column showing the 'Others_avg' total. Is there a way to have the 'You' and 'Other_avg' displayed as two separate columns?

0 Karma

somesoni2
Revered Legend

Try the new version.

0 Karma

mcram52
New Member

Almost there! Thank you so much for working with me on this. There's two separate columns now but one is on top of the other (not stacked, but separated). Any way the columns can be placed side by side? It almost looks like the x and y axis need to be switched if that's possible.

0 Karma

mcram52
New Member

Nevermind, figured it out. Thanks!

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...