Splunk Search

How do I perform eval function on chart values?

Romeo_James
Engager

Example Search:
Index=*
|chart count over Character
|addcoltotals

Example output:

Char ........Count

A.................21
B.................13
C.................54
D.................11
....................99


Is it possible to take the addcoltotals and divide it by the value of C (54/99) using an eval func?

0 Karma
1 Solution

renjith_nair
Legend

@Romeo_James ,

Try,

    index=*
   |chart count over Character
   |eventstats sum(count) as Total
   |addcoltotals
   |eval X=if(Character=="C",count/Total,"")|fields - Total

You can remove the condition, if you want the values for all characters

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@Romeo_James ,

Try,

    index=*
   |chart count over Character
   |eventstats sum(count) as Total
   |addcoltotals
   |eval X=if(Character=="C",count/Total,"")|fields - Total

You can remove the condition, if you want the values for all characters

---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...