Splunk Search

Math Within addtotals

icrit
Explorer

I'm trying to do some math with the values calculated in the addtotals command and put them back into the same line but I can't seem to figure out how to do that.

| eval daysEmployed = round((end - HireDate)/86400,0)
| eval daysCanWork = if(HireDate <= start, numWorkDay, round((daysEmployed/7)*5,0))
| eval posibleHours=(daysCanWork-numHolidays) * 8
| eval totWorked=Billable+NonBillable
| eval perBill=Billable/posibleHours
| eval perNonBill=NonBillable/posibleHours
| eval perWorked=totWorked / posibleHours
| eval Billable=round(Billable,2)
| eval NonBillable=round(NonBillable,2)
| eval totWorked=round(totWorked,2)
| eval perBill=round(perBill,2)*100
| eval perNonBill=round(perNonBill,2)*100
| eval perWorked=round(perWorked,2)*100
| addtotals col=true labelfield=Employee Label="Totals" posibleHours Billable NonBillable totWorked
| eval perWorked=perWorked + "%"
| eval perBill=perBill + "%"
| eval perNonBill=perNonBill + "%"
| sort -perBill
| eval HireDate=strftime(HireDate,"%m/%d/%Y")
| rename "Billing Class" as "Job Title", posibleHours as "Possible Hrs Worked", Billable as "Billable Time", NonBillable as "Non Billable time", totWorked as "Total Hrs Worked", perBill as "% Billable Time Worked", perNonBill as "% Non Billable Time Worked", perWorked as "Total % of time Worked", HireDate as "Date Hired"
| fields Employee, "Job Title", "Date Hired", "Possible Hrs Worked", "Billable Time", "Non Billable time", "Total Hrs Worked", "% Billable Time Worked", "% Non Billable Time Worked", "Total % of time Worked"

I'd like to do the following:

Billable / totworked = perBill
NonBillable / totWorked = perNonBill
possibleHours / totWorked = perWorked

If I just add the perBill,perNonBill,perWorked I just get the sums of those columns which is not what I'm trying to acomplish.

0 Karma
1 Solution

cmerriman
Super Champion

will the following work:

... | addtotals col=true labelfield=Employee Label="Totals" posibleHours Billable NonBillable totWorked
 |eval perBill=if(Employee="Totals",round(Billable / totworked,2)*100."%",perBill."%")
 |eval perNonBill=if(Employee="Totals",round(NonBillable / totWorked,2)*100."%",perNonBill."%")
 |eval perWorked=if(Employee="Totals",round(possibleHours / totWorked,2)*100."%",perWorked."%")
 | sort -perBill
 | eval HireDate=strftime(HireDate,"%m/%d/%Y")
 | rename "Billing Class" as "Job Title", posibleHours as "Possible Hrs Worked", Billable as "Billable Time", NonBillable as "Non Billable time", totWorked as "Total Hrs Worked", perBill as "% Billable Time Worked", perNonBill as "% Non Billable Time Worked", perWorked as "Total % of time Worked", HireDate as "Date Hired"
 | fields Employee, "Job Title", "Date Hired", "Possible Hrs Worked", "Billable Time", "Non Billable time", "Total Hrs Worked", "% Billable Time Worked", "% Non Billable Time Worked", "Total % of time Worked"

View solution in original post

cmerriman
Super Champion

will the following work:

... | addtotals col=true labelfield=Employee Label="Totals" posibleHours Billable NonBillable totWorked
 |eval perBill=if(Employee="Totals",round(Billable / totworked,2)*100."%",perBill."%")
 |eval perNonBill=if(Employee="Totals",round(NonBillable / totWorked,2)*100."%",perNonBill."%")
 |eval perWorked=if(Employee="Totals",round(possibleHours / totWorked,2)*100."%",perWorked."%")
 | sort -perBill
 | eval HireDate=strftime(HireDate,"%m/%d/%Y")
 | rename "Billing Class" as "Job Title", posibleHours as "Possible Hrs Worked", Billable as "Billable Time", NonBillable as "Non Billable time", totWorked as "Total Hrs Worked", perBill as "% Billable Time Worked", perNonBill as "% Non Billable Time Worked", perWorked as "Total % of time Worked", HireDate as "Date Hired"
 | fields Employee, "Job Title", "Date Hired", "Possible Hrs Worked", "Billable Time", "Non Billable time", "Total Hrs Worked", "% Billable Time Worked", "% Non Billable Time Worked", "Total % of time Worked"

icrit
Explorer

That worked flawlessly! Thank you for your help!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...