Splunk Search

How to create a pie chart after applying math on column values extracted?

Path Finder

Hey people, my requirement is as such


I have extracted these columns from my data using the query 


my query | rex "filterExecutionTime=(?<FET>[^,]+)" | rex "ddbWriteExecutionTime=(?<ddbET>[^)]+)" | rex "EXECUTION_TIME : (?<totalTime>[^ ms]+)" | eval buildAndTearDowTime=(tonumber(FET)) + (tonumber(ddbET)) |table totalTime FET ddbET buildAndTearDownTime



I want to have buildAndTearDown as totalTime - (FET+ ddbET)


once I have all the three values required (FET, ddbET, buildAndTearDown) I want to put these values in a pie chart.


Thanks 😊 

Labels (2)
0 Karma


Hi @sjs ,

You have a typo in your eval , you are missing in buildAndTearDown, please try below;

my query 
| rex "filterExecutionTime=(?<FET>[^,]+)" 
| rex "ddbWriteExecutionTime=(?<ddbET>[^)]+)" 
| rex "EXECUTION_TIME : (?<totalTime>[^ ms]+)" 
| eval buildAndTearDownTime=(tonumber(FET)) + (tonumber(ddbET)) 
| table totalTime FET ddbET buildAndTearDownTime


If this reply helps you an upvote is appreciated.

Path Finder

Hey people, Can I get some help

0 Karma

Path Finder

This statement 

eval buildAndTearDowTime=(tonumber(FET)) + (tonumber(ddbET))

is giving me null value

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...