Splunk Search

Using calculated values to create timechart -- too many columns

EricLloyd79
Builder

Hello, I know this type of question has been asked several times: ex:

http://answers.splunk.com/answers/11020/display-calculated-values-in-a-timechart

But I have tried that example and am getting column bars for my total when I just want column bars for my calculated values. Im basically trying to create a chart that return the percentages of a total value but I dont want the values I used (count, total) to be included on the timechart. Here is my query:

XXXXXX NOT(resultType=XXXX) activity=foo OR activity=bar
| timechart span=1h count by activity
| eval total = foo + bar
| eval percAddTrials = round(foo*100/total,1)
| eval percAddSub = round(bar*100/total,1)

I've been working on this for a few days. I started initially trying to use appendcols and that seemed to work somewhat as well:

XXXXX NOT(resultType=XXX) activity=foo
| timechart span=1h count as foo_total
| appendcols
   [search XXXXX NOT(resultType=XXX) activity=bar 
      | timechart span=1h count as bar_total]
| eval total = foo_total + bar_total 
| eval percFoo = round(foo_total*100/total,1)
| eval percBar = round(bar_total*100/total,1)

But this gave me the same issue of displaying the column bars of total and the counts. Any suggestions?

0 Karma
1 Solution

lguinn2
Legend

All you should need to do, is to add a final line to your search, eliminating the fields you don't want:

XXXXXX NOT(resultType=XXXX) activity=foo OR activity=bar
| timechart span=1h count by activity
| eval total = foo + bar
| eval percAddTrials = round(foo*100/total,1)
| eval percAddSub = round(bar*100/total,1)
| fields - total

View solution in original post

lguinn2
Legend

All you should need to do, is to add a final line to your search, eliminating the fields you don't want:

XXXXXX NOT(resultType=XXXX) activity=foo OR activity=bar
| timechart span=1h count by activity
| eval total = foo + bar
| eval percAddTrials = round(foo*100/total,1)
| eval percAddSub = round(bar*100/total,1)
| fields - total
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...