Splunk Search

Select my extracted fields for correlation in timechart

sbnoobbb
Path Finder

I am using a search command of sourcetype=CurrentWeatherSGMap OR sourcetype=ltaTraffic | timechart count(type) as Incident count(current_summary) as Rain.

I had current_summary and type, which I needed only the Rain from current_summary and Accident from type in both sources using the search query. Anyway I can do it ?

alt text

alt text

0 Karma
1 Solution

Ayn
Legend

Did you read the timechart docs? You can specify which field values you are interested in using eval statements. So something like this should work:

sourcetype=CurrentWeatherSGMap OR sourcetype=ltaTraffic | timechart count(eval(type=="Accident")) as Incident, count(eval(current_summary=="Rain")) as Rain

View solution in original post

Ayn
Legend

Did you read the timechart docs? You can specify which field values you are interested in using eval statements. So something like this should work:

sourcetype=CurrentWeatherSGMap OR sourcetype=ltaTraffic | timechart count(eval(type=="Accident")) as Incident, count(eval(current_summary=="Rain")) as Rain

View solution in original post

kailun92
Communicator

Kk, i am just double checking 😃 I am only not sure about the two sourcetype. Thanks ! Eval is what i needed 😃

0 Karma

Ayn
Legend

Uh...well yes. That's kind of basic search filtering functionality. If you're unsure about those kind of things I advise you to take the Splunk tutorial.

0 Karma

kailun92
Communicator

Consider that both sourcetype have these location fields extracted.

0 Karma

kailun92
Communicator

What if i got another field called location and I need the location of "PIE" for example? Only display result for PIE, how can i do that ? Put at by location=PIE ?

0 Karma

kailun92
Communicator

Yes ! Against the same location !

0 Karma

Ayn
Legend

So the desired result would be a graph with two lines - one for occurrences of rain and one for occurrences of accidents?

0 Karma

sbnoobbb
Path Finder

I wanted to do a search for Rain and Accident on a timechart showing how rain affects more accidents (correlation of weather and traffic accidents). However the Accident is in Type and Rain is in current_summary. I need to do a count for number of times it rains on a specific location then count for accidents on the same location then plot it on a timechart.

0 Karma

Ayn
Legend

OK, but I have no idea what your desired result is (same issue as in your partner's more or less identical question). What exactly are you trying to do? What is the desired end result?

0 Karma

sbnoobbb
Path Finder

I have edited the question. Check it out 😃

0 Karma

Ayn
Legend

xmlkv is used for performing field extraction on certain XML formatted data. Not sure how it would be relevant in your scenario.

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!