Splunk Search

Timechart expression - No results found.

splunk_zen
Builder

I'm having trouble computing an aggregate performance indicator.
The following expression (which has the goal to obtain a value up to 100 to feed a radial gauge ) is working,

index=resources_reporting source="*/output/ora_queries/client07/OS_metrics.csv"
| fields USED_CPU HOST_NAME
| eval Platform = case(
HOST_NAME like "%scp%" AND NOT (HOST_NAME like "%dscp%"), "SCPs", 
HOST_NAME like "%dscp%", "DSCPs",
    ...
HOST_NAME like "%mgr%", "MGRs"
)
| eval OptimumCpu = case(
Platform=="SCPs" AND USED_CPU <= 60, 1,
Platform=="DSCPs" AND USED_CPU <= 60, 1,
    ...
Platform=="MGRs" AND USED_CPU <= 60, 1
)
| eval AcceptableCpu = case(
Platform=="SCPs" AND USED_CPU > 60 AND USED_CPU <= 75, 1,
Platform=="DSCPs" AND USED_CPU > 60 AND USED_CPU <= 75, 1,
    ...
Platform=="MGRs" AND USED_CPU > 60 AND USED_CPU <= 75, 1
)
| stats count(USED_CPU) as TotalEvents sum(OptimumCpu) as TotalOptimumCpu sum(AcceptableCpu) as TotalAcceptableCpu by Platform
| fillnull
| eval ScpCpu=if(Platform="SCPs",(TotalOptimumCpu + TotalAcceptableCpu/2) / TotalEvents,0)
| eval DscpCpu=if(Platform="DSCPs",(TotalOptimumCpu + TotalAcceptableCpu/2) / TotalEvents,0)
    ...
| eval MgrCpu=if(Platform="MGRs",(TotalOptimumCpu + TotalAcceptableCpu/2) / TotalEvents,0)
| eval ApdexScore=round(100*(0.17*ScpCpu + 0.17*DscpCpu + ... + 0.04*MgrCpu),2)
    | stats sum(ApdexScore) as TotalApdexScore

which returns something like 99.96,
however I'm missing why I can't get the correponding aggregate time evolution in a line chart, replacing the last line with,

| timechart (ApdexScore) as TotalApdexScore

which returns

No results found.

What should I change to get a timechart of my ApdexScore expression ?

Tags (3)
0 Karma
1 Solution

Ant1D
Motivator

Hi splunk_zen, looking at your query, it seems that you are not bringing the _time field to the point when you need it. Add the _time field to the end of your | stats pipes.

View solution in original post

Ant1D
Motivator

Hi splunk_zen, looking at your query, it seems that you are not bringing the _time field to the point when you need it. Add the _time field to the end of your | stats pipes.

MuS
SplunkTrust
SplunkTrust

just did that, go ahead and accept it 😉

0 Karma

splunk_zen
Builder

So simple...
Thanks !

I'll accept your comment as an answer if you promote it.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...