Splunk Search

How to create a pie chart after applying math on column values extracted?

sjs
Path Finder

Hey people, my requirement is as such

sjs_0-1673428861777.png

I have extracted these columns from my data using the query 

 

my query | rex "filterExecutionTime=(?<FET>[^,]+)" | rex "ddbWriteExecutionTime=(?<ddbET>[^)]+)" | rex "EXECUTION_TIME : (?<totalTime>[^ ms]+)" | eval buildAndTearDowTime=(tonumber(FET)) + (tonumber(ddbET)) |table totalTime FET ddbET buildAndTearDownTime

 

 

I want to have buildAndTearDown as totalTime - (FET+ ddbET)

 

once I have all the three values required (FET, ddbET, buildAndTearDown) I want to put these values in a pie chart.

 

Thanks 😊 

Labels (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @sjs ,

You have a typo in your eval , you are missing in buildAndTearDown, please try below;

my query 
| rex "filterExecutionTime=(?<FET>[^,]+)" 
| rex "ddbWriteExecutionTime=(?<ddbET>[^)]+)" 
| rex "EXECUTION_TIME : (?<totalTime>[^ ms]+)" 
| eval buildAndTearDownTime=(tonumber(FET)) + (tonumber(ddbET)) 
| table totalTime FET ddbET buildAndTearDownTime

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

sjs
Path Finder

Hey people, Can I get some help

0 Karma

sjs
Path Finder

This statement 

eval buildAndTearDowTime=(tonumber(FET)) + (tonumber(ddbET))

is giving me null value

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...