Dashboards & Visualizations

adding two columns and plot timechart

mrigendra
New Member

Hi, I want to plot sum of two columns and plot it as timechart. Here is what I am doing,

source="2weeks.csv" | timechart eval(sum(FemaleGTotal) + sum(MaleGTotal))

This doesn't seems to work, where as both the following queries run fine.

source="2weeks.csv" | timechart sum(FemaleGTotal)

source="2weeks.csv" | timechart sum(MaleGTotal)
Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Use:

... | timechart sum(F) as sumf, sum(M) as summ | eval t=sumf+summ

Unless you're looking for:

... | timechart sum( eval(F + M) ) as t

Which differs in how null values are handled.

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Use:

... | timechart sum(F) as sumf, sum(M) as summ | eval t=sumf+summ

Unless you're looking for:

... | timechart sum( eval(F + M) ) as t

Which differs in how null values are handled.

0 Karma

mrigendra
New Member

@gkanapathy: thanks, both queries are helpful to me. But what you mean, when you say that they differ in how null values are handled?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...