Splunk Search

How to develop a timechart by host with eval command?

kualo
Explorer

Hi,

I have the below search to find the SLA of my application by host in the specific time span.
But I don't know why it won't show up SLA

some search | timechart span=30m count as VOLUME count(eval(respTime<=10)) as COUNT by host | eval SLA=COUNT/VOLUME*100

I want to show SLA and VOLUME together in the line graph so I tried below but it didn't work

some search | timechart span=30m count as VOLUME count(eval(respTime<=10)) as COUNT by host | eval SLA=COUNT/VOLUME*100 | fields + _time VOLUME SLA

Can someone help? Thanks!

0 Karma
1 Solution

somesoni2
Revered Legend

The problem here is that when you use the timechart ( or chart command) with a by clause, the field name that you're going to see will be _time and VOLUME: host1, VOLUME: host2.... and COUNT: host1, COUNT: host2.... So when you're doing a SLA calculation, the field that you refer (plain COUNT and VOLUME) doesn't exist and hence it's not shown in the graph. In fact, if you check the legend of your line chart, you can see the name of the series will be similar to what I mentioned earlier.

If you want to show to total VOLUME and SLA for each host in a timechart, try like this.

some search | bucket span=30m _time | stats count as VOLUME count(eval(respTime<=10)) as COUNT by _time host | eval SLA=COUNT*100/VOLUME | timechart values(VOLUME) as VOLUME values(SLA) as SLA by host

Again, as mentioned earlier, you'd get fields like _time VOLUME:host1 VOLUME:host2... SLA:host1 SLA:host2...

View solution in original post

somesoni2
Revered Legend

The problem here is that when you use the timechart ( or chart command) with a by clause, the field name that you're going to see will be _time and VOLUME: host1, VOLUME: host2.... and COUNT: host1, COUNT: host2.... So when you're doing a SLA calculation, the field that you refer (plain COUNT and VOLUME) doesn't exist and hence it's not shown in the graph. In fact, if you check the legend of your line chart, you can see the name of the series will be similar to what I mentioned earlier.

If you want to show to total VOLUME and SLA for each host in a timechart, try like this.

some search | bucket span=30m _time | stats count as VOLUME count(eval(respTime<=10)) as COUNT by _time host | eval SLA=COUNT*100/VOLUME | timechart values(VOLUME) as VOLUME values(SLA) as SLA by host

Again, as mentioned earlier, you'd get fields like _time VOLUME:host1 VOLUME:host2... SLA:host1 SLA:host2...

kualo
Explorer

Thanks! it works!

0 Karma

badamastor
Engager

This is exactly what I was looking for! Now, to what I believe is the easy part, I wanted to add a constant red line, indicating the SLA limit. I tried placing eval sla=99 , but it never shows.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...