Splunk Search

Problem with timechart after a join

New Member

My base search is just building a timechart of 3 utilization rates over time. Two rates come from one source, one from another via a join. Seems to work fine.

index=XXXX sourcetype="XXXX"
| eval Booked_tilization=substr(BookedUtilization , 1, len(BookedUtilization )-1)
| eval mytime=strptime(MonthYear, "%m/%d/%Y")
| eval _time=mytime
| eval "Room GUID"=substr(SynergyID , 1, len(SynergyID )-10)
| lookup XXXXXX.csv "Room GUID"
| join type=outer "System Name" [search index=XXXX sourcetype="XXXXX" | rename "Endpoint Name" as "System Name"]
| timechart span=1mon eval(round(avg(BookedUtilization),2)) as "Booked Utilization %" eval(round(avg(PanelUtilization),2)) as "Panel Utilization %" eval(round(avg('Utilization Rate'),2)) as "VC Utilization %"

alt text

However, if I specify a room number, the first two still work but the third breaks and gives you a repeating number. The number it gives (36.85) is the average for that room over all months.

alt text

Any guidance is appreciated!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...