Splunk Search

Is it possible to modify "chart" command results

aboitsau
New Member

Hello,

Our index has the following data: method name (amf_name), execution time (call_dur), application_version (app_version). I am trying to build a statistics table of average values for every method for every app_version (top 10, sorted desc). I also want the columns to be in a specific order - method name, then specific version averages, then any other averages.
The current query that is working is

host=prod09 | chart avg(call_dur) by amf_name app_version | table amf_name, "01.20.00.00", * | sort 10 - "01.20.00.00"

The result looks like:

amf_name 01.20.00.00 01.30.00.00 01.40.00.00 ...
execute 10.25 11.4 10.74 ...
...

What I want to see in this table is method name, average for a specified app version, and then for every app version - a delta between this average value and average for that version. So the result looks like

amf_name 01.20.00.00 01.30.00.00 01.40.00.00 ...
execute 10.25 1.15 0.49 ...
...

I have tried using foreach, but it does not go through "01...." columns. It seems to be aware only about amf_name results column. Which seems strange, as when I address any column by the exact name like "01.20.00.00" I am able to change the data using eval. The question here is how to address a column without knowing its name and build statistics for all available application versions.

Thank you in advance.

Tags (2)
0 Karma
1 Solution

sundareshr
Legend

When you use foreach on columns with numeric names, you have to put <<FIELD>> in single quotes. Like this '<<FIELD>>'

View solution in original post

0 Karma

sundareshr
Legend

When you use foreach on columns with numeric names, you have to put <<FIELD>> in single quotes. Like this '<<FIELD>>'

0 Karma

aboitsau
New Member

Ah, yes, you are right. I have probably messed up quotes on either side of the equation. The query that shows exactly what I'm looking for is

host=prod09 | chart eval(round(avg(call_dur),2)) by amf_name app_version | sort 10 - "01.20.00.00" | foreach 0* [eval <<FIELD>> = if(('<<FIELD>>'!='01.20.00.00'),'<<FIELD>>' - '01.20.00.00','01.20.00.00')] | table amf_name, "01.20.00.00", *
0 Karma

sundareshr
Legend

If this answered your question, please accept the answer so its marked answered. Thanks

0 Karma

aboitsau
New Member

To be completely honest it did not really answer the question, but definitely pointed me to the right direction. Thank you!

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...