Splunk Search

How can I get the graph that only displays percentage when using timechart?

New Member

I have a query below that is showing "PriceChangeCount", "Total" and "PriceChangeRate" in graph, How can I get the graph that only displays the PriceChangeRate in graph?

index=xxx sourcetype=xxx|eval priceChangeCnt=case(Id=xxx,"Yes") | timechart span=1h count as Total, count(priceChangeCnt) as PriceChangeCount | eval PriceChangeRate=(PriceChangeCount/Total)*100

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

try this:

index=xxx sourcetype=xxx
|eval priceChangeCnt=case(Id=xxx,"Yes") 
|bin _time span=1h 
| stats count as Total, count(priceChangeCnt) as PriceChangeCount by _time
| eval PriceChangeRate=(PriceChangeCount/Total)*100
| timechart span=1h max(PriceChangeRate) as m_PriceChangeRate

hope it helps

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

try this:

index=xxx sourcetype=xxx
|eval priceChangeCnt=case(Id=xxx,"Yes") 
|bin _time span=1h 
| stats count as Total, count(priceChangeCnt) as PriceChangeCount by _time
| eval PriceChangeRate=(PriceChangeCount/Total)*100
| timechart span=1h max(PriceChangeRate) as m_PriceChangeRate

hope it helps

View solution in original post

0 Karma

New Member

Hi adonio, many thanks! It works well.

0 Karma