Splunk Search

How do i reference columns that have been displayed as a result of previous chart command

New Member

I have done a chart command --> chart count over "Survey Month" by "Survey Type" and the result displays the two survey types "a" and "b" as columns along with Survey month . Now how do i further reference column a and b to perform other calculations?

Tags (2)
0 Karma
1 Solution

Revered Legend

After chart command, you'd see value of "Survey Type" field appearing as separate fields (in your example "a" and "b"). So you'd reference them like any other field, but would use "a" or "b" instead of "Survey Type". If they contain spaces, hyphen or other special characters, use them within single quotes in eval and where expressions, and within double quotes in other places.

e.g. (just an example of syntax)

base search | chart count over "Survey Month" by "Survey Type"  | eval "a"='a'*20 | where 'b'<'a'  | stats sum("b") as "B" by "a"

View solution in original post

0 Karma

Esteemed Legend

You should just be able to use a and b but if you need it to be oriented differently, then you can switch from using chart to using stats or you could use the untable command to do the same thing.

0 Karma

Revered Legend

After chart command, you'd see value of "Survey Type" field appearing as separate fields (in your example "a" and "b"). So you'd reference them like any other field, but would use "a" or "b" instead of "Survey Type". If they contain spaces, hyphen or other special characters, use them within single quotes in eval and where expressions, and within double quotes in other places.

e.g. (just an example of syntax)

base search | chart count over "Survey Month" by "Survey Type"  | eval "a"='a'*20 | where 'b'<'a'  | stats sum("b") as "B" by "a"

View solution in original post

0 Karma

New Member

Thanks a ton! This helps!

0 Karma

SplunkTrust
SplunkTrust

@monyathomas If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Builder

Can you provide some sample data and a more clear idea of what calculations you are looking to do after the initial chart command?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!