Splunk Search

## Why does this chart work, but this table doesn't?

Path Finder

I would like to apply a formula to each of the values in the field "stocks."  I have been able to show this in a chart, but I need it as a table... what is going on here?

The values in day_hour and stocks are strings.  Flow is a numeric value.  Pct should be a numeric value.

``| chart sum(eval(flow*100))AS pct BY day_hour stocks``

The charting command produces the following.  This is how I want my table to look.

 day_hour stock_name_A stock_name_B stock_name_C 2020-01-01  00:00 2020-01-01  01:00 2020-01-01  02:00

Instead, my table looks like this:

 day_hour stocks pct 2020-01-01  00:00 stock_name_A 2020-01-01  00:00 stock_name_B 2020-01-01  00:00 stock_name_C 2020-01-01  01:00 stock_name_A 2020-01-01  01:00 stock_name_B 2020-01-01  01:00 stock_name_C 2020-01-01  02:00 stock_name_A 2020-01-01  02:00 stock_name_B 2020-01-01  02:00 stock_name_C

Labels (3)

• ### table

1 Solution
Path Finder

I solved this with a workaround that may not be the most "splunkable" solution, but provides the answer results I am looking for.

``````|eval splitfield=stocks+"_pct"
|stats sum(eval(flow*100))AS pct BY day_hour splitfield
|table day_hour pct splitfield
|eval {splitfield}=pct
|fields -splitfield,pct
|stats values(*) AS * BY day_hour
|fillnull

Path Finder

I solved this with a workaround that may not be the most "splunkable" solution, but provides the answer results I am looking for.

``````|eval splitfield=stocks+"_pct"
|stats sum(eval(flow*100))AS pct BY day_hour splitfield
|table day_hour pct splitfield
|eval {splitfield}=pct
|fields -splitfield,pct
|stats values(*) AS * BY day_hour
|fillnull

SplunkTrust

Try

``| chart sum(eval(flow*100))AS pct over day_hour BY stocks``
Happy Splunking!
Path Finder

Thank you for your reply @renjith_nair but I am trying to create a table.  The chart command I am using creates the intended format... but the table command does not.

Do you know why this is happening?

SplunkTrust

Have you tried chart over? What happens when you change visualization to stats/table.

Happy Splunking!
SplunkTrust
``| xyseries day_hour stocks pct``
Get Updates on the Splunk Community!