Splunk Search

## How to manipulate stats or chart results mathematically?

New Member

Hey everyone,

I've got a search

``````search = *
| eval _time=_time - (6*60*60)
| bucket _time span=1d

# Takes the current time and rolls it back six hours. We operate on a 6am-6am reporting schedule.

| eval MaterialType = case(match(lotNumber,"regex") OR lotNumber = "WasteLots","Waste",match(field1,"regex"),"Production")

# Designates each event as a waste event (using the Lot #) or a production event (using the value in field1)

| where isnotnull(MaterialType)
| eval time = strftime(_time,"%m/%d/%y")
| chart sum(netWeightQty) by time, MaterialType
| eval _time=_time + (6*60*60)
``````

Now this | chart generates the following:

How can I get a value, for each date, of Waste% = 100 * Waste / (Production + Waste)?

Thanks!

Tags (3)
1 Solution
SplunkTrust

@MaxwellCrew,

``````|eval "Waste%" = (100 * Waste) / (Production + Waste)
``````
SplunkTrust

@MaxwellCrew,

``````|eval "Waste%" = (100 * Waste) / (Production + Waste)
``````
New Member

Welp. Definitely didn't realize it was that easy.

New Member

Quick question: how can I go about getting the visualization to work? I am using the "Single value" option, with trend, and it is only taking the waste% value for the first date in the span and reporting it.

Edit: Playing around with the | timechart command now.

SplunkTrust

Alright, just one suggestion - try not to change the _time . use another variable for calculations to and use that variable instead.

Take the 2021 Splunk Career Survey

### Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey.Earn \$50 in Amazon cash! Full Details! >

Get Updates on the Splunk Community!