Splunk Search

Avg count of last weeks to current week by day.

sandeepmakkena
Contributor

| multisearch
[ search sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TID earliest=-2w@w1 latest=@w1
| eval event="1", when="then"
| eval event=event/2]
[ search sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TID earliest=@w1 latest=@h+h
| eval event="1", when="now" ]
| eval Hour = strftime(_time,"%H")
| chart sum(event) AS events over date_wday by when
| eval sort_field = case(date_wday=="monday", 1,
date_wday=="tuesday", 2,
date_wday=="wednesday", 3,
date_wday=="thursday", 4,
date_wday=="friday", 5,
date_wday=="saturday", 6,
date_wday=="sunday", 7)
| sort 0 sort_field
| fields - sort_field

This seems to working fine, but I want the avg count to be always a integer. I tried round and other functions they didn't work.

0 Karma
1 Solution

niketn
Legend

@sandeepmakkena do you want the following?

| eval then=round(then,0)

Also, event eval does not seem necessary based on your query. Can you try the following?

| multisearch 
    [ search sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TID earliest=-2w@w1 latest=@w1
    | eval when="then"] 
    [ search sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TID earliest=@w1 latest=@h+h
    | eval when="now" ]
| chart count by date_wday when
| eval then=round(then/2,0)
| eval sort_field = case(date_wday=="monday", 1,
date_wday=="tuesday", 2,
date_wday=="wednesday", 3,
date_wday=="thursday", 4,
date_wday=="friday", 5,
date_wday=="saturday", 6,
date_wday=="sunday", 7) 
| sort 0 sort_field 
| fields - sort_field
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

jnudell_2
Builder

Hi @sandeepmakkena ,

Round should work for providing an integer value as a result, but remember it's rounding, meaning if you have 3.51 it would round it to 4, and not set it to 3.
After your | chart ... line you would put:

| eval events = round(events, 0)

If you want to drop the fraction instead of rounding you would use:

| eval events = mvindex(split(events, ".", 0)

0 Karma

niketn
Legend

@sandeepmakkena do you want the following?

| eval then=round(then,0)

Also, event eval does not seem necessary based on your query. Can you try the following?

| multisearch 
    [ search sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TID earliest=-2w@w1 latest=@w1
    | eval when="then"] 
    [ search sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TID earliest=@w1 latest=@h+h
    | eval when="now" ]
| chart count by date_wday when
| eval then=round(then/2,0)
| eval sort_field = case(date_wday=="monday", 1,
date_wday=="tuesday", 2,
date_wday=="wednesday", 3,
date_wday=="thursday", 4,
date_wday=="friday", 5,
date_wday=="saturday", 6,
date_wday=="sunday", 7) 
| sort 0 sort_field 
| fields - sort_field
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

sandeepmakkena
Contributor

This seems to be working, Thanks for your time.

0 Karma

niketn
Legend

@sandeepmakkena I have converted my comment to answer. If your issue is resolved please accept to mark this question as answered.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@sandeepmakkena if your issue is resolved, dont forget to mark the question as answered as this would help others facing similar issue as well.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
Revered Legend

Any specific reason to have | eval event=event/2 in your first query?

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...