Splunk Search

How to manipulate stats or chart results mathematically?

MaxwellCrew
New Member

Hey everyone,

I've got a search

search = *
| eval _time=_time - (6*60*60) 
| bucket _time span=1d

# Takes the current time and rolls it back six hours. We operate on a 6am-6am reporting schedule.

| eval MaterialType = case(match(lotNumber,"regex") OR lotNumber = "WasteLots","Waste",match(field1,"regex"),"Production")

# Designates each event as a waste event (using the Lot #) or a production event (using the value in field1)

| where isnotnull(MaterialType)
| eval time = strftime(_time,"%m/%d/%y")
| chart sum(netWeightQty) by time, MaterialType
| eval _time=_time + (6*60*60)

Now this | chart generates the following:

Big money big money

How can I get a value, for each date, of Waste% = 100 * Waste / (Production + Waste)?

Thanks!

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@MaxwellCrew,

Just add the same to the end of your search i.e

|eval "Waste%" = (100 * Waste) / (Production + Waste)
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@MaxwellCrew,

Just add the same to the end of your search i.e

|eval "Waste%" = (100 * Waste) / (Production + Waste)
Happy Splunking!
0 Karma

MaxwellCrew
New Member

Welp. Definitely didn't realize it was that easy.

0 Karma

MaxwellCrew
New Member

Quick question: how can I go about getting the visualization to work? I am using the "Single value" option, with trend, and it is only taking the waste% value for the first date in the span and reporting it.

Edit: Playing around with the | timechart command now.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Alright, just one suggestion - try not to change the _time . use another variable for calculations to and use that variable instead.

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...