Splunk Search

Is it possible to modify "chart" command results

aboitsau
New Member

Hello,

Our index has the following data: method name (amf_name), execution time (call_dur), application_version (app_version). I am trying to build a statistics table of average values for every method for every app_version (top 10, sorted desc). I also want the columns to be in a specific order - method name, then specific version averages, then any other averages.
The current query that is working is

host=prod09 | chart avg(call_dur) by amf_name app_version | table amf_name, "01.20.00.00", * | sort 10 - "01.20.00.00"

The result looks like:

amf_name 01.20.00.00 01.30.00.00 01.40.00.00 ...
execute 10.25 11.4 10.74 ...
...

What I want to see in this table is method name, average for a specified app version, and then for every app version - a delta between this average value and average for that version. So the result looks like

amf_name 01.20.00.00 01.30.00.00 01.40.00.00 ...
execute 10.25 1.15 0.49 ...
...

I have tried using foreach, but it does not go through "01...." columns. It seems to be aware only about amf_name results column. Which seems strange, as when I address any column by the exact name like "01.20.00.00" I am able to change the data using eval. The question here is how to address a column without knowing its name and build statistics for all available application versions.

Thank you in advance.

Tags (2)
0 Karma
1 Solution

sundareshr
Legend

When you use foreach on columns with numeric names, you have to put <<FIELD>> in single quotes. Like this '<<FIELD>>'

View solution in original post

0 Karma

sundareshr
Legend

When you use foreach on columns with numeric names, you have to put <<FIELD>> in single quotes. Like this '<<FIELD>>'

0 Karma

aboitsau
New Member

Ah, yes, you are right. I have probably messed up quotes on either side of the equation. The query that shows exactly what I'm looking for is

host=prod09 | chart eval(round(avg(call_dur),2)) by amf_name app_version | sort 10 - "01.20.00.00" | foreach 0* [eval <<FIELD>> = if(('<<FIELD>>'!='01.20.00.00'),'<<FIELD>>' - '01.20.00.00','01.20.00.00')] | table amf_name, "01.20.00.00", *
0 Karma

sundareshr
Legend

If this answered your question, please accept the answer so its marked answered. Thanks

0 Karma

aboitsau
New Member

To be completely honest it did not really answer the question, but definitely pointed me to the right direction. Thank you!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...