Splunk Search

Add a percentage row into a chart?

ganinurceski
Engager

Hello there!

I want to add a percentage row into a chart table.

string:
index=smsc tag=MPRO_PRODUCTION DATA="8000000400000000" OR "8000000400000058" | dedup DATA | chart count by SHORT_ID, command_status_code | search NOT ESME_RTHROTTLED=0 | sort - ESME_RTHROTTLED | head 15

And the chart table:
alt text

The red result, is what i need to add. the Value in it should be calculated like the blue marked.
ESME_RTHROTTLED value get divided by ESME_RTHROTTLED and ESME_ROK together.
Can someone help me?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You're asking for a column, not a row. Columns can be created with the eval command.

... | eval "THROTTLING %" = ESME_RTHROTTLED / (ESME_ROK + ESME_RTHROTTLED) * 100
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You're asking for a column, not a row. Columns can be created with the eval command.

... | eval "THROTTLING %" = ESME_RTHROTTLED / (ESME_ROK + ESME_RTHROTTLED) * 100
---
If this reply helps you, Karma would be appreciated.
0 Karma

ganinurceski
Engager

Does this add the column automatically in the chart table?

0 Karma

mydog8it
Builder

It will add the desired column to your results. However your sample data uses 223/(ESME_ROK + ESME_RTHROTTLED) * 100 as the formula. If that is right the search should be...

your_search | eval "THROTTLING %"=(223/(ESME_RTHROTTLED + ESME_ROK)*100)

0 Karma

ganinurceski
Engager

Thx! it worked!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...