Dashboards & Visualizations

How to create a new variable using Eval and then pass it in Timechart

aditsss
Motivator

Hi Everyone,

I need to create one variable using Eval my variable name is  - JOB_EXEC_TIME how can I create a variable using eval.

And then I need to pass it in below query:

timechart sum(JOB_EXEC_TIME) as TotalExecTime by JOB_NM

Can someone guide me How can I do this in splunk.

Labels (3)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@aditsss 

 

Can you please share more details where you want to create variable like (from input or search result) and how you want to use in time chart?

0 Karma

aditsss
Motivator

@kamlesh_vaghela 

Currently I am passing JOB_EXEC_TIME is my timechart like below:

 

 timechart sum(JOB_EXEC_TIME) as TotalExecTime by JOB_NM

 

Now I want to pass -JOB_EXEC_TIME(reverse order) in timechart.How can I pass that.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust
Did you tried?

|timechart sum("JOB_EXEC_TIME(reverse order)") as TotalExecTime by JOB_NM
0 Karma

aditsss
Motivator

@kamlesh_vaghela 

nothing is coming

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust
Is it possible to share sample OP of search before time chart?
0 Karma

aditsss
Motivator

@kamlesh_vaghela 

what is OP?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust
Output
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...