Splunk Search

How do I represent an Eval result with timechart?

rafasalo
Engager

Hi,

With the support of Splunk's community, I have this search below. However, right now I would like to take the result and use the timechart command so I can see each hour. How do I do this?

index= "index_cbo_pt" "AcquirerResponseCode=0" | stats count as Result1 | appendcols [search index= "index_cbo_pt" "AcquirerResponseCode=0" | stats dc(MerchantCheckoutId) as Result2] | eval finalValue = Result1/Result2 | table finalValue Result1 Result2

Can somebody help me?

0 Karma
1 Solution

polymorphic
Communicator

Im not sure why you want to do the 'appencols' in this search.

This should be the solution:

index=index_cbo_pt AcquirerResponseCode=0
 | timechart span=1h count as Result1 dc(MerchantCheckoutId) as Result2
 | eval finalValue = Result1/Result2
 | fields _time finalValue Result1 Result2

Try it out.

View solution in original post

0 Karma

javiergn
Super Champion

Timechart requires a timestamp so remove the table line and use

timechart list(finalValue) WHATEVEROTHERPARAMETERSYOUWANT
0 Karma

rafasalo
Engager

I've tried the query bellow and haven't worked.

index= "index_cbo_pt" "AcquirerResponseCode=0" | stats count as Result1 | appendcols [search index= "index_cbo_pt" "AcquirerResponseCode=0" | stats dc(MerchantCheckoutId) as Result2] | eval finalValue = Result1/Result2 | timechart list(finalValue) count

thanks!

0 Karma

javiergn
Super Champion

You don't need the last 'count'. Simply define a span and let the list represent all your values

polymorphic
Communicator

Im not sure why you want to do the 'appencols' in this search.

This should be the solution:

index=index_cbo_pt AcquirerResponseCode=0
 | timechart span=1h count as Result1 dc(MerchantCheckoutId) as Result2
 | eval finalValue = Result1/Result2
 | fields _time finalValue Result1 Result2

Try it out.

0 Karma

rafasalo
Engager

Thank your! It works!!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...