Splunk Search

How to create a rate on a timechart with two measures?

taynord
Engager

Works just fine

| timechart  count  by orderLineState
| eval cancelRate=round((cancelled/(cancelled+released))*100,2)

But when I add a second measure in the time chart I can't figure out how to get values I need back out for the cancelRate

| timechart max(node) as m_node count  by orderLineState
| eval cancelRate=round((cancelled/(cancelled+released))*100,2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Pay attention to the field names produced by the timechart, likely count: cancelled etc.

... | eval cancelRate = round(('count: cancelled' / ('count: cancelled' + 'count: released')) * 100, 2)

View solution in original post

woodcock
Esteemed Legend

Like this:

index=_* component IN("Metrics", "PerProcess")
|  eval component=if(component=="Metrics", "released", "cancelled")
| rename component as orderLineState

| rename COMMENT AS "everything above generates sample events; everything below is your solution"

| timechart  count max(date_hour) AS m_node BY orderLineState
| eval cancelRate=round(('count: cancelled' / ('count: cancelled' + 'count: released')) * 100, 2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Pay attention to the field names produced by the timechart, likely count: cancelled etc.

... | eval cancelRate = round(('count: cancelled' / ('count: cancelled' + 'count: released')) * 100, 2)
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...