Splunk Search

Timechart values using an eval field

dojiepreji
Path Finder

Hello all,

I have a search that goes like this:

index="_internal" (ticket_type="Incident") (classification="level-1" OR classification="level-2") (ticket_status="Closed" OR ticket_status="Resolved")
| stats dc(ticket_number) as "score" 
| eval r = 1 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-1" OR classification="level-2") (NOT ticket_status="Cancelled") (ticket_contract="Breached") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 1 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-1" OR classification="level-2") (ticket_status="Closed" OR ticket_status="Resolved") (NOT ticket_source="Alert") `comment("Priority Level 1 and 2 - Excluding Alerts)")` 
    | stats dc(ticket_number) as "score" 
    | eval r = 2 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-1" OR classification="level-2") (NOT ticket_status="Cancelled") (sla_response="Breached") (NOT ticket_source="Alert") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 2 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-1") (ticket_status="Closed" OR ticket_status="Resolved") 
    | stats dc(ticket_number) as "score" 
    | eval r = 3 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-1") (NOT ticket_status="Cancelled") (ticket_contract="Breached") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 3 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-2") (ticket_status="Closed" OR ticket_status="Resolved") 
    | eval r = 4 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-2") (NOT ticket_status="Cancelled") (ticket_contract="Breached") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 4 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-2") (ticket_status="Closed" OR ticket_status="Resolved") (NOT ticket_source="Alert") `comment("Priority 2 - Excluding Alerts")` 
    | stats dc(ticket_number) as "score" 
    | eval r = 5 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-2") (NOT ticket_status="Cancelled") (ticket_contract="Breached") (NOT ticket_source="Alert") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 5 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-3") (ticket_status="Closed" OR ticket_status="Resolved") 
    | stats dc(ticket_number) as "score" 
    | eval r = 6 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-3") (NOT ticket_status="Cancelled") (ticket_contract="Breached") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 6 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-3") (ticket_status="Closed" OR ticket_status="Resolved") 
    | stats dc(ticket_number) as "score" 
    | eval r = 7 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-3") (NOT ticket_status="Cancelled") (ticket_contract="Breached") (NOT ticket_source="Alert") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 7 ] 
| selfjoin r 
| eval met = score - missed 
| eval performance = round((met / score) * 100, 2) 

I am able to get the performance just fine.
However, I have to get the value of performance every month. I have tried:

| timechart span=1mon list(performance) as performance

...but nothing gets returned.

Can anybody please point me in the right direction?

Thank you.

0 Karma
1 Solution

HiroshiSatoh
Champion

Because _time does not exist.
Add "bin span = month _time" and "stats XXX by _time".

 | stats dc(ticket_number) as "score" 
 | eval r = 1 
↓
 | bin span=month _time
 | stats dc(ticket_number) as "score" by _time 
 | eval r = 1 

View solution in original post

0 Karma

HiroshiSatoh
Champion

Because _time does not exist.
Add "bin span = month _time" and "stats XXX by _time".

 | stats dc(ticket_number) as "score" 
 | eval r = 1 
↓
 | bin span=month _time
 | stats dc(ticket_number) as "score" by _time 
 | eval r = 1 
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...