Splunk Search

Timechart values using an eval field

Path Finder

Hello all,

I have a search that goes like this:

index="_internal" (ticket_type="Incident") (classification="level-1" OR classification="level-2") (ticket_status="Closed" OR ticket_status="Resolved")
| stats dc(ticket_number) as "score" 
| eval r = 1 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-1" OR classification="level-2") (NOT ticket_status="Cancelled") (ticket_contract="Breached") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 1 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-1" OR classification="level-2") (ticket_status="Closed" OR ticket_status="Resolved") (NOT ticket_source="Alert") `comment("Priority Level 1 and 2 - Excluding Alerts)")` 
    | stats dc(ticket_number) as "score" 
    | eval r = 2 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-1" OR classification="level-2") (NOT ticket_status="Cancelled") (sla_response="Breached") (NOT ticket_source="Alert") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 2 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-1") (ticket_status="Closed" OR ticket_status="Resolved") 
    | stats dc(ticket_number) as "score" 
    | eval r = 3 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-1") (NOT ticket_status="Cancelled") (ticket_contract="Breached") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 3 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-2") (ticket_status="Closed" OR ticket_status="Resolved") 
    | eval r = 4 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-2") (NOT ticket_status="Cancelled") (ticket_contract="Breached") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 4 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-2") (ticket_status="Closed" OR ticket_status="Resolved") (NOT ticket_source="Alert") `comment("Priority 2 - Excluding Alerts")` 
    | stats dc(ticket_number) as "score" 
    | eval r = 5 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-2") (NOT ticket_status="Cancelled") (ticket_contract="Breached") (NOT ticket_source="Alert") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 5 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-3") (ticket_status="Closed" OR ticket_status="Resolved") 
    | stats dc(ticket_number) as "score" 
    | eval r = 6 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-3") (NOT ticket_status="Cancelled") (ticket_contract="Breached") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 6 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-3") (ticket_status="Closed" OR ticket_status="Resolved") 
    | stats dc(ticket_number) as "score" 
    | eval r = 7 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-3") (NOT ticket_status="Cancelled") (ticket_contract="Breached") (NOT ticket_source="Alert") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 7 ] 
| selfjoin r 
| eval met = score - missed 
| eval performance = round((met / score) * 100, 2) 

I am able to get the performance just fine.
However, I have to get the value of performance every month. I have tried:

| timechart span=1mon list(performance) as performance

...but nothing gets returned.

Can anybody please point me in the right direction?

Thank you.

0 Karma
1 Solution

Champion

Because _time does not exist.
Add "bin span = month _time" and "stats XXX by _time".

 | stats dc(ticket_number) as "score" 
 | eval r = 1 
↓
 | bin span=month _time
 | stats dc(ticket_number) as "score" by _time 
 | eval r = 1 

View solution in original post

0 Karma

Champion

Because _time does not exist.
Add "bin span = month _time" and "stats XXX by _time".

 | stats dc(ticket_number) as "score" 
 | eval r = 1 
↓
 | bin span=month _time
 | stats dc(ticket_number) as "score" by _time 
 | eval r = 1 

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!