Splunk Enterprise

How to calculate a percentage in a timechart table?

jip31
Motivator

hello

 

I timechart a lot of search in a table and it works perfectly

here is the result

jip31_0-1649070134564.png

But for the piece of code below I try to find a solution in order to be able to calculate a percentage between sign and eue2 and to timechart the results like above instead having a separate result for sign field and for eue2 result

 

 

| appendcols 
    [ search index=toto
    | timechart span=1h dc(sign) as sign  ] 
| append 
    [ search index=toto  
    | timechart span=1h dc(eue2) as eue2]

 

 

I need something like this :

| eval perc=(sign/eueu2) | timechart values(p) span=1h

 could you help please?

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0 header_field=KPI column_name=KPI
| eval percentage=round(100*sign/eue2,2)
| transpose 0 header_field=KPI column_name=KPI

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0 header_field=KPI column_name=KPI
| eval percentage=round(100*sign/eue2,2)
| transpose 0 header_field=KPI column_name=KPI
0 Karma

jip31
Motivator
oh thanks
 
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...