Splunk Search

Timechart with eval

cet
Engager

We are showing a timechart with bandwidth in kilobits per second. We would like to transform this data into kilobytes per second. So the value of bandwidth divided by 1024.

This is the query:

name="Bandwidth by Client"  (515502 OR 410407 OR 414565 OR 444422 OR 777777) | timechart median(measures.Bandwidth) by "dimensions.Client Name"

I tried various things, such as adding an eval before, and then piping it on to the timechart, and also adding an eval function around the median function. But nothing seems to work.

We are using Splunk 6.0.1

Thank you in advance
Gidon

Tags (2)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi cet,

assuming your kilobits field name is measures.Bandwidth you can do the following:

name="Bandwidth by Client" (515502 OR 410407 OR 414565 OR 444422 OR 777777) | eval measures.Bandwidth='measures.Bandwidth'/1024 | timechart median(measures.Bandwidth) by "dimensions.Client Name"

you can also rename the median in the timechart like this:

name="Bandwidth by Client" (515502 OR 410407 OR 414565 OR 444422 OR 777777) | eval measures.Bandwidth='measures.Bandwidth'/1024 | timechart median(measures.Bandwidth) AS median.KB.Bandwidth by "dimensions.Client Name"

watch out for the '' around the field name in eval, else eval will not ignore the dot in the name. Or rename your field to something without . in the name before the eval.

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi cet,

assuming your kilobits field name is measures.Bandwidth you can do the following:

name="Bandwidth by Client" (515502 OR 410407 OR 414565 OR 444422 OR 777777) | eval measures.Bandwidth='measures.Bandwidth'/1024 | timechart median(measures.Bandwidth) by "dimensions.Client Name"

you can also rename the median in the timechart like this:

name="Bandwidth by Client" (515502 OR 410407 OR 414565 OR 444422 OR 777777) | eval measures.Bandwidth='measures.Bandwidth'/1024 | timechart median(measures.Bandwidth) AS median.KB.Bandwidth by "dimensions.Client Name"

watch out for the '' around the field name in eval, else eval will not ignore the dot in the name. Or rename your field to something without . in the name before the eval.

hope this helps ...

cheers, MuS

MuS
SplunkTrust
SplunkTrust

you're welcome 🙂

0 Karma

cet
Engager

GREAT!!! Thanks a million!

0 Karma

MuS
SplunkTrust
SplunkTrust

facepalm stupid me, see my update to fix it 😉

0 Karma

cet
Engager

did you mean:

name="Bandwidth by Client" (515502 OR 410407 OR 414565 OR 444422 OR 777777)| eval measures.Bandwidth=measures.Bandwidth/1024

this does return events. I also checked that measurs.Bandwidth is a number, and yes splunk recognizes it as a number.

0 Karma

MuS
SplunkTrust
SplunkTrust

remove everything after the eval and see if you get anything

0 Karma

cet
Engager

Once I add the eval expression , my timechart stops working. The statistics tab shows 0 stats. What could be the problem?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...