Splunk Search

Percentage Timechart

tkwaller
Builder

Hello

I'm trying to add a percentage for each day. Here is what I have:

index=tt OrderIntegration.asmx "PlaceOrderResponse" ("RealTime" OR "AdvancedSale") | timechart span=1d count(eval(searchmatch("RealTime"))) as NumberofRealTimeListings, count(eval(searchmatch("AdvancedSale"))) as NumberofNonRealTimeListings, sum(eval("NumberofNonRealTimeListings"/"NumberofRealTimeListings")) as Percent 

Any ideas what I'm missing?

Tags (2)
0 Karma
1 Solution

gfuente
Motivator

Hello

Have you tried to eval the percentage after the timechart, like:

index=tt OrderIntegration.asmx "PlaceOrderResponse" ("RealTime" OR "AdvancedSale") | timechart span=1d count(eval(searchmatch("RealTime"))) as NumberofRealTimeListings, count(eval(searchmatch("AdvancedSale"))) as NumberofNonRealTimeListings | eval Percent = (NumberofNonRealTimeListings/NumberofRealTimeListings)*100

Regards

View solution in original post

gfuente
Motivator

Hello

Have you tried to eval the percentage after the timechart, like:

index=tt OrderIntegration.asmx "PlaceOrderResponse" ("RealTime" OR "AdvancedSale") | timechart span=1d count(eval(searchmatch("RealTime"))) as NumberofRealTimeListings, count(eval(searchmatch("AdvancedSale"))) as NumberofNonRealTimeListings | eval Percent = (NumberofNonRealTimeListings/NumberofRealTimeListings)*100

Regards

chandusubash
New Member

How can I use this percentage and plot it in a timechart ? Can someone help.

0 Karma

tkwaller
Builder

I actually got that after I added that comment. Thanks for the direction!

0 Karma

tkwaller
Builder

Yes when I did this I got "Error in 'eval' command: Typechecking failed. '/' only takes numbers."

0 Karma

gfuente
Motivator

You are right! edited the answer

0 Karma

kristian_kolb
Ultra Champion

also, I think you should remove the double quotes around the field names in the eval.

Get Updates on the Splunk Community!

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...

New Year. New Skills. New Course Releases from Splunk Education

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...