Timechart Table Question

[jhayIV]

Is there a way to add a column to the table below that divides each value by the IS&O to value to get a column that shows compliance?

Example for Tuesday I would like to have a column that divides System Role by IS&O Servers 10046/11683, 86%

Also is there a way to remove the _span entries at the bottom?

[cmerriman · Accepted solution]

as long as you're only looking at a 7 day time window, try this:

| timechart span=1d dc(Name) as "IS&O Servers" , Count(SystemRole) as "System Role", count(IsVirtual) as "Virtual Flag", count(OS) as "OS Relationships",count(Site) as "Location",count(Serial_Number) as "Serial Number",count(Domain) as "Domain",count(NumberOfProcessors) as "Processors",count(Total_Physical_Memory) as "Memory"| eval _time=strftime(_time, "%A")|fields - _span*|foreach * [eval <<MATCHSTR>>_perc='<<FIELD>>'/'IS&O Servers']|fields - "IS&O Servers_perc"| transpose header_field=_time

[jhayIV]

That is perfect, is there a way to do it as a column for each date? This appended the perc's to the bottom of the table.

[cmerriman]

This took a bit of thought but I think it should work.

| timechart span=1d dc(Name) as "IS&O Servers" , Count(SystemRole) as "System Role", count(IsVirtual) as "Virtual Flag", count(OS) as "OS Relationships",count(Site) as "Location",count(Serial_Number) as "Serial Number",count(Domain) as "Domain",count(NumberOfProcessors) as "Processors",count(Total_Physical_Memory) as "Memory"| eval _time=strftime(_time, "%A")|fields - _span*|foreach * [eval <<MATCHSTR>>_perc='<<FIELD>>'/'IS&O Servers']|fields - "IS&O Servers_perc"|appendpipe [stats values(*_perc) as * by _time]|eval _time=if(isnull('IS&O Servers'),_time+"_perc",_time)|fields - *_perc| transpose 14 header_field=_time

[jhayIV]

Impressive, thanks man!

[aaraneta_splunk]

@jhayIV - If cmerriman helped to answer your question, please accept her answer and up-vote any helpful comments from her. Thanks!

[jhayIV]

It didnt allow me to post an image here is the code I was using

| timechart span=1d dc(Name) as "IS&O Servers" , Count(SystemRole) as "System Role", count(IsVirtual) as "Virtual Flag", count(OS) as "OS Relationships",count(Site) as "Location",count(Serial_Number) as "Serial Number",count(Domain) as "Domain",count(NumberOfProcessors) as "Processors",count(Total_Physical_Memory) as "Memory"| eval _time=strftime(_time, "%A")| transpose

[cmerriman]

are you doing just a 7 day span for your search? I'm just thinking if you do 2 weeks, it isn't going to combine your Thursdays together in the transpose.