Splunk Search

Timechart with multiple fields and calculating percentage

benobviate
Explorer

My query is something like

.. | eval color_and_shape = color + "/" + shape
| timechart count as total, count(eval(heavy="true")) as heavy by color_and_shape

which returns a table similar to

_time heavy:green/triangle heavy:green/circle total:green/triangle total:green/circle

11/20/12 1 2 5 6

How would I go about calculating the percentage of shapes that a heavy by color_and_shape?

I tried doing ...| eval pct=sc/total
but this does not work.

1 Solution

jonuwz
Influencer

The problem is that after you've run the results through timechart, you no longer know all the combinations of column headers you'll need to calculate the percentage.

A better way of approaching this would be to work out the percentages before running timechart like this :

... | eval color_and_shape = color + "/" + shape
    | bin _time span=1d 
    | stats count as total, count(eval(heavy="true")) as heavy by color_and_shape _time 
    | eval perc_heavy=100*heavy/total 

Then you can do the timechart

... | timechart span=1d first(total) as total first(heavy) as heavy first(perc_heavy) as perc_heavy by color_and_shape

View solution in original post

jonuwz
Influencer

The problem is that after you've run the results through timechart, you no longer know all the combinations of column headers you'll need to calculate the percentage.

A better way of approaching this would be to work out the percentages before running timechart like this :

... | eval color_and_shape = color + "/" + shape
    | bin _time span=1d 
    | stats count as total, count(eval(heavy="true")) as heavy by color_and_shape _time 
    | eval perc_heavy=100*heavy/total 

Then you can do the timechart

... | timechart span=1d first(total) as total first(heavy) as heavy first(perc_heavy) as perc_heavy by color_and_shape
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...