Splunk Search

Math Within addtotals

icrit
Explorer

I'm trying to do some math with the values calculated in the addtotals command and put them back into the same line but I can't seem to figure out how to do that.

| eval daysEmployed = round((end - HireDate)/86400,0)
| eval daysCanWork = if(HireDate <= start, numWorkDay, round((daysEmployed/7)*5,0))
| eval posibleHours=(daysCanWork-numHolidays) * 8
| eval totWorked=Billable+NonBillable
| eval perBill=Billable/posibleHours
| eval perNonBill=NonBillable/posibleHours
| eval perWorked=totWorked / posibleHours
| eval Billable=round(Billable,2)
| eval NonBillable=round(NonBillable,2)
| eval totWorked=round(totWorked,2)
| eval perBill=round(perBill,2)*100
| eval perNonBill=round(perNonBill,2)*100
| eval perWorked=round(perWorked,2)*100
| addtotals col=true labelfield=Employee Label="Totals" posibleHours Billable NonBillable totWorked
| eval perWorked=perWorked + "%"
| eval perBill=perBill + "%"
| eval perNonBill=perNonBill + "%"
| sort -perBill
| eval HireDate=strftime(HireDate,"%m/%d/%Y")
| rename "Billing Class" as "Job Title", posibleHours as "Possible Hrs Worked", Billable as "Billable Time", NonBillable as "Non Billable time", totWorked as "Total Hrs Worked", perBill as "% Billable Time Worked", perNonBill as "% Non Billable Time Worked", perWorked as "Total % of time Worked", HireDate as "Date Hired"
| fields Employee, "Job Title", "Date Hired", "Possible Hrs Worked", "Billable Time", "Non Billable time", "Total Hrs Worked", "% Billable Time Worked", "% Non Billable Time Worked", "Total % of time Worked"

I'd like to do the following:

Billable / totworked = perBill
NonBillable / totWorked = perNonBill
possibleHours / totWorked = perWorked

If I just add the perBill,perNonBill,perWorked I just get the sums of those columns which is not what I'm trying to acomplish.

0 Karma
1 Solution

cmerriman
Super Champion

will the following work:

... | addtotals col=true labelfield=Employee Label="Totals" posibleHours Billable NonBillable totWorked
 |eval perBill=if(Employee="Totals",round(Billable / totworked,2)*100."%",perBill."%")
 |eval perNonBill=if(Employee="Totals",round(NonBillable / totWorked,2)*100."%",perNonBill."%")
 |eval perWorked=if(Employee="Totals",round(possibleHours / totWorked,2)*100."%",perWorked."%")
 | sort -perBill
 | eval HireDate=strftime(HireDate,"%m/%d/%Y")
 | rename "Billing Class" as "Job Title", posibleHours as "Possible Hrs Worked", Billable as "Billable Time", NonBillable as "Non Billable time", totWorked as "Total Hrs Worked", perBill as "% Billable Time Worked", perNonBill as "% Non Billable Time Worked", perWorked as "Total % of time Worked", HireDate as "Date Hired"
 | fields Employee, "Job Title", "Date Hired", "Possible Hrs Worked", "Billable Time", "Non Billable time", "Total Hrs Worked", "% Billable Time Worked", "% Non Billable Time Worked", "Total % of time Worked"

View solution in original post

cmerriman
Super Champion

will the following work:

... | addtotals col=true labelfield=Employee Label="Totals" posibleHours Billable NonBillable totWorked
 |eval perBill=if(Employee="Totals",round(Billable / totworked,2)*100."%",perBill."%")
 |eval perNonBill=if(Employee="Totals",round(NonBillable / totWorked,2)*100."%",perNonBill."%")
 |eval perWorked=if(Employee="Totals",round(possibleHours / totWorked,2)*100."%",perWorked."%")
 | sort -perBill
 | eval HireDate=strftime(HireDate,"%m/%d/%Y")
 | rename "Billing Class" as "Job Title", posibleHours as "Possible Hrs Worked", Billable as "Billable Time", NonBillable as "Non Billable time", totWorked as "Total Hrs Worked", perBill as "% Billable Time Worked", perNonBill as "% Non Billable Time Worked", perWorked as "Total % of time Worked", HireDate as "Date Hired"
 | fields Employee, "Job Title", "Date Hired", "Possible Hrs Worked", "Billable Time", "Non Billable time", "Total Hrs Worked", "% Billable Time Worked", "% Non Billable Time Worked", "Total % of time Worked"

icrit
Explorer

That worked flawlessly! Thank you for your help!

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...