Splunk Search

Timechart with multiple fields and calculating percentage

benobviate
Explorer

My query is something like

.. | eval color_and_shape = color + "/" + shape
| timechart count as total, count(eval(heavy="true")) as heavy by color_and_shape

which returns a table similar to

_time heavy:green/triangle heavy:green/circle total:green/triangle total:green/circle

11/20/12 1 2 5 6

How would I go about calculating the percentage of shapes that a heavy by color_and_shape?

I tried doing ...| eval pct=sc/total
but this does not work.

1 Solution

jonuwz
Influencer

The problem is that after you've run the results through timechart, you no longer know all the combinations of column headers you'll need to calculate the percentage.

A better way of approaching this would be to work out the percentages before running timechart like this :

... | eval color_and_shape = color + "/" + shape
    | bin _time span=1d 
    | stats count as total, count(eval(heavy="true")) as heavy by color_and_shape _time 
    | eval perc_heavy=100*heavy/total 

Then you can do the timechart

... | timechart span=1d first(total) as total first(heavy) as heavy first(perc_heavy) as perc_heavy by color_and_shape

View solution in original post

jonuwz
Influencer

The problem is that after you've run the results through timechart, you no longer know all the combinations of column headers you'll need to calculate the percentage.

A better way of approaching this would be to work out the percentages before running timechart like this :

... | eval color_and_shape = color + "/" + shape
    | bin _time span=1d 
    | stats count as total, count(eval(heavy="true")) as heavy by color_and_shape _time 
    | eval perc_heavy=100*heavy/total 

Then you can do the timechart

... | timechart span=1d first(total) as total first(heavy) as heavy first(perc_heavy) as perc_heavy by color_and_shape

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.