- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would like to apply a formula to each of the values in the field "stocks." I have been able to show this in a chart, but I need it as a table... what is going on here?
The values in day_hour and stocks are strings. Flow is a numeric value. Pct should be a numeric value.
| chart sum(eval(flow*100))AS pct BY day_hour stocks
The charting command produces the following. This is how I want my table to look.
day_hour | stock_name_A | stock_name_B | stock_name_C |
2020-01-01 00:00 | |||
2020-01-01 01:00 | |||
2020-01-01 02:00 |
Instead, my table looks like this:
day_hour | stocks | pct |
2020-01-01 00:00 | stock_name_A | |
2020-01-01 00:00 | stock_name_B | |
2020-01-01 00:00 | stock_name_C | |
2020-01-01 01:00 | stock_name_A | |
2020-01-01 01:00 | stock_name_B | |
2020-01-01 01:00 | stock_name_C | |
2020-01-01 02:00 | stock_name_A | |
2020-01-01 02:00 | stock_name_B | |
2020-01-01 02:00 | stock_name_C |
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I solved this with a workaround that may not be the most "splunkable" solution, but provides the answer results I am looking for.
|eval splitfield=stocks+"_pct"
|stats sum(eval(flow*100))AS pct BY day_hour splitfield
|table day_hour pct splitfield
|eval {splitfield}=pct
|fields -splitfield,pct
|stats values(*) AS * BY day_hour
|fillnull
|addtotals
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I solved this with a workaround that may not be the most "splunkable" solution, but provides the answer results I am looking for.
|eval splitfield=stocks+"_pct"
|stats sum(eval(flow*100))AS pct BY day_hour splitfield
|table day_hour pct splitfield
|eval {splitfield}=pct
|fields -splitfield,pct
|stats values(*) AS * BY day_hour
|fillnull
|addtotals
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Try
| chart sum(eval(flow*100))AS pct over day_hour BY stocks
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for your reply @renjith_nair but I am trying to create a table. The chart command I am using creates the intended format... but the table command does not.
Do you know why this is happening?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Have you tried chart over? What happens when you change visualization to stats/table.
Please find attached .
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

| xyseries day_hour stocks pct
