Dashboards & Visualizations

adding two columns and plot timechart

mrigendra
New Member

Hi, I want to plot sum of two columns and plot it as timechart. Here is what I am doing,

source="2weeks.csv" | timechart eval(sum(FemaleGTotal) + sum(MaleGTotal))

This doesn't seems to work, where as both the following queries run fine.

source="2weeks.csv" | timechart sum(FemaleGTotal)

source="2weeks.csv" | timechart sum(MaleGTotal)
Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Use:

... | timechart sum(F) as sumf, sum(M) as summ | eval t=sumf+summ

Unless you're looking for:

... | timechart sum( eval(F + M) ) as t

Which differs in how null values are handled.

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Use:

... | timechart sum(F) as sumf, sum(M) as summ | eval t=sumf+summ

Unless you're looking for:

... | timechart sum( eval(F + M) ) as t

Which differs in how null values are handled.

0 Karma

mrigendra
New Member

@gkanapathy: thanks, both queries are helpful to me. But what you mean, when you say that they differ in how null values are handled?

0 Karma
Get Updates on the Splunk Community!

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...

New Year. New Skills. New Course Releases from Splunk Education

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...