Splunk Enterprise

How to calculate a percentage in a timechart table?

jip31
Motivator

hello

 

I timechart a lot of search in a table and it works perfectly

here is the result

jip31_0-1649070134564.png

But for the piece of code below I try to find a solution in order to be able to calculate a percentage between sign and eue2 and to timechart the results like above instead having a separate result for sign field and for eue2 result

 

 

| appendcols 
    [ search index=toto
    | timechart span=1h dc(sign) as sign  ] 
| append 
    [ search index=toto  
    | timechart span=1h dc(eue2) as eue2]

 

 

I need something like this :

| eval perc=(sign/eueu2) | timechart values(p) span=1h

 could you help please?

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0 header_field=KPI column_name=KPI
| eval percentage=round(100*sign/eue2,2)
| transpose 0 header_field=KPI column_name=KPI

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0 header_field=KPI column_name=KPI
| eval percentage=round(100*sign/eue2,2)
| transpose 0 header_field=KPI column_name=KPI
0 Karma

jip31
Motivator
oh thanks
 
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...