Splunk Search
Highlighted

Divide Time Chart Results by 2

Path Finder
index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appnodes/PrefComm-API-Space/*/log/bwappnode*.log"  MessageType != "NULL" | timechart span=1d count by MessageType limit=0

I've tried to eval my counts of several different message types by 2 but it's not working. Any suggestions? I've worked around this issue by using a stats count instead of a timechart but I would like to figure this out within a timechart.

Tags (3)
0 Karma
Highlighted

Re: Divide Time Chart Results by 2

Esteemed Legend

I have 2 answers.

This is how you can achieve the same thing:

index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appnodes/PrefComm-API-Space/*/log/bwappnode*.log"  MessageType != "NULL" | timechart span=1d count by MessageType limit=0 | foreach * [eval <<FIELD>> = if((isnum($<<FIELD>>$)), $<<FIELD>>$/2, $<<FIELD>>$)]

This is how you can do exactly what you asked:

index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appnodes/PrefComm-API-Space/*/log/bwappnode*.log"  MessageType != "NULL" | eval half=1/2 | timechart span=1d sum(half) by MessageType limit=0

View solution in original post

Highlighted

Re: Divide Time Chart Results by 2

Path Finder

This works great! What's the best way to get rid of the decimal places? Eval round?

0 Karma
Highlighted

Re: Divide Time Chart Results by 2

Esteemed Legend

Yes, that's the way to do it.

0 Karma
Highlighted

Re: Divide Time Chart Results by 2

Path Finder

This is what I ended up doing but I want to time chart instead.

index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appnodes/PrefComm-API-Space/*/log/bwappnode*.log"  MessageType = "PostCommunicationContact" OR MessageType="GetCommunicationContactsRequest" OR MessageType="charter.enterprise.deletecontactpoints.request" OR MessageType="charter.enterprise.SaveContactDataByValue.request" OR MessageType="charter.enterprise.findEventCommunicationByApplicationIdAndServiceEventId.request" OR MessageType="charter.enterprise.findUIEventFamilyByApplicationID.request" OR MessageType="charter.enterprise.findContactsByAccountNumberAndBillingSystem.request" OR MessageType="charter.enterprise.getcommpreference.request" OR MessageType="charter.enterprise.getcontactpoints.request" OR MessageType="charter.enterprise.savecommpreference.request" OR MessageType="charter.enterprise.deletecommpreference.request" | stats count by MessageType  | eval count=count/2 | eval count=round(count)
0 Karma