Dashboards & Visualizations

adding two columns and plot timechart

mrigendra
New Member

Hi, I want to plot sum of two columns and plot it as timechart. Here is what I am doing,

source="2weeks.csv" | timechart eval(sum(FemaleGTotal) + sum(MaleGTotal))

This doesn't seems to work, where as both the following queries run fine.

source="2weeks.csv" | timechart sum(FemaleGTotal)

source="2weeks.csv" | timechart sum(MaleGTotal)
Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Use:

... | timechart sum(F) as sumf, sum(M) as summ | eval t=sumf+summ

Unless you're looking for:

... | timechart sum( eval(F + M) ) as t

Which differs in how null values are handled.

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Use:

... | timechart sum(F) as sumf, sum(M) as summ | eval t=sumf+summ

Unless you're looking for:

... | timechart sum( eval(F + M) ) as t

Which differs in how null values are handled.

0 Karma

mrigendra
New Member

@gkanapathy: thanks, both queries are helpful to me. But what you mean, when you say that they differ in how null values are handled?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...

Developer Spotlight with Mika Borner

From Hackathon Winner to Enterprise Leader    Mika Borner, CEO and Founder of Datapunctum AG, has been ...

Continue Your Federation Journey: Join Session 3 of the Bootcamp Series

To help practitioners build a stronger foundation, we launched the Data Management & Federation ...