Splunk Search

How to manipulate stats or chart results mathematically?

MaxwellCrew
New Member

Hey everyone,

I've got a search

search = *
| eval _time=_time - (6*60*60) 
| bucket _time span=1d

# Takes the current time and rolls it back six hours. We operate on a 6am-6am reporting schedule.

| eval MaterialType = case(match(lotNumber,"regex") OR lotNumber = "WasteLots","Waste",match(field1,"regex"),"Production")

# Designates each event as a waste event (using the Lot #) or a production event (using the value in field1)

| where isnotnull(MaterialType)
| eval time = strftime(_time,"%m/%d/%y")
| chart sum(netWeightQty) by time, MaterialType
| eval _time=_time + (6*60*60)

Now this | chart generates the following:

Big money big money

How can I get a value, for each date, of Waste% = 100 * Waste / (Production + Waste)?

Thanks!

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@MaxwellCrew,

Just add the same to the end of your search i.e

|eval "Waste%" = (100 * Waste) / (Production + Waste)

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@MaxwellCrew,

Just add the same to the end of your search i.e

|eval "Waste%" = (100 * Waste) / (Production + Waste)

View solution in original post

0 Karma

MaxwellCrew
New Member

Welp. Definitely didn't realize it was that easy.

0 Karma

MaxwellCrew
New Member

Quick question: how can I go about getting the visualization to work? I am using the "Single value" option, with trend, and it is only taking the waste% value for the first date in the span and reporting it.

Edit: Playing around with the | timechart command now.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Alright, just one suggestion - try not to change the _time . use another variable for calculations to and use that variable instead.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!