Splunk Enterprise

How to calculate a percentage in a timechart table?

jip31
Motivator

hello

 

I timechart a lot of search in a table and it works perfectly

here is the result

jip31_0-1649070134564.png

But for the piece of code below I try to find a solution in order to be able to calculate a percentage between sign and eue2 and to timechart the results like above instead having a separate result for sign field and for eue2 result

 

 

| appendcols 
    [ search index=toto
    | timechart span=1h dc(sign) as sign  ] 
| append 
    [ search index=toto  
    | timechart span=1h dc(eue2) as eue2]

 

 

I need something like this :

| eval perc=(sign/eueu2) | timechart values(p) span=1h

 could you help please?

Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0 header_field=KPI column_name=KPI
| eval percentage=round(100*sign/eue2,2)
| transpose 0 header_field=KPI column_name=KPI

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0 header_field=KPI column_name=KPI
| eval percentage=round(100*sign/eue2,2)
| transpose 0 header_field=KPI column_name=KPI
0 Karma

jip31
Motivator
oh thanks
 
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...