Splunk Enterprise

How to calculate a percentage in a timechart table?

jip31
Motivator

hello

 

I timechart a lot of search in a table and it works perfectly

here is the result

jip31_0-1649070134564.png

But for the piece of code below I try to find a solution in order to be able to calculate a percentage between sign and eue2 and to timechart the results like above instead having a separate result for sign field and for eue2 result

 

 

| appendcols 
    [ search index=toto
    | timechart span=1h dc(sign) as sign  ] 
| append 
    [ search index=toto  
    | timechart span=1h dc(eue2) as eue2]

 

 

I need something like this :

| eval perc=(sign/eueu2) | timechart values(p) span=1h

 could you help please?

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0 header_field=KPI column_name=KPI
| eval percentage=round(100*sign/eue2,2)
| transpose 0 header_field=KPI column_name=KPI

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0 header_field=KPI column_name=KPI
| eval percentage=round(100*sign/eue2,2)
| transpose 0 header_field=KPI column_name=KPI
0 Karma

jip31
Motivator
oh thanks
 
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...