Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to develop a timechart by host with eval comma...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have the below search to find the SLA of my application by host in the specific time span.
But I don't know why it won't show up SLA
some search | timechart span=30m count as VOLUME count(eval(respTime<=10)) as COUNT by host | eval SLA=COUNT/VOLUME*100
I want to show SLA and VOLUME together in the line graph so I tried below but it didn't work
some search | timechart span=30m count as VOLUME count(eval(respTime<=10)) as COUNT by host | eval SLA=COUNT/VOLUME*100 | fields + _time VOLUME SLA
Can someone help? Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The problem here is that when you use the timechart ( or chart command) with a by clause, the field name that you're going to see will be _time and VOLUME: host1, VOLUME: host2.... and COUNT: host1, COUNT: host2.... So when you're doing a SLA calculation, the field that you refer (plain COUNT and VOLUME) doesn't exist and hence it's not shown in the graph. In fact, if you check the legend of your line chart, you can see the name of the series will be similar to what I mentioned earlier.
If you want to show to total VOLUME and SLA for each host in a timechart, try like this.
some search | bucket span=30m _time | stats count as VOLUME count(eval(respTime<=10)) as COUNT by _time host | eval SLA=COUNT*100/VOLUME | timechart values(VOLUME) as VOLUME values(SLA) as SLA by host
Again, as mentioned earlier, you'd get fields like _time VOLUME:host1 VOLUME:host2... SLA:host1 SLA:host2...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The problem here is that when you use the timechart ( or chart command) with a by clause, the field name that you're going to see will be _time and VOLUME: host1, VOLUME: host2.... and COUNT: host1, COUNT: host2.... So when you're doing a SLA calculation, the field that you refer (plain COUNT and VOLUME) doesn't exist and hence it's not shown in the graph. In fact, if you check the legend of your line chart, you can see the name of the series will be similar to what I mentioned earlier.
If you want to show to total VOLUME and SLA for each host in a timechart, try like this.
some search | bucket span=30m _time | stats count as VOLUME count(eval(respTime<=10)) as COUNT by _time host | eval SLA=COUNT*100/VOLUME | timechart values(VOLUME) as VOLUME values(SLA) as SLA by host
Again, as mentioned earlier, you'd get fields like _time VOLUME:host1 VOLUME:host2... SLA:host1 SLA:host2...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks! it works!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is exactly what I was looking for! Now, to what I believe is the easy part, I wanted to add a constant red line, indicating the SLA limit. I tried placing eval sla=99 , but it never shows.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
