Splunk Search

Why does this chart work, but this table doesn't?

CarbonCriterium
Path Finder

I would like to apply a formula to each of the values in the field "stocks."  I have been able to show this in a chart, but I need it as a table... what is going on here?  

The values in day_hour and stocks are strings.  Flow is a numeric value.  Pct should be a numeric value. 

 

 

| chart sum(eval(flow*100))AS pct BY day_hour stocks

 


The charting command produces the following.  This is how I want my table to look.  

day_hourstock_name_Astock_name_Bstock_name_C
2020-01-01  00:00   
2020-01-01  01:00   
2020-01-01  02:00   

 

Instead, my table looks like this:

day_hourstockspct
2020-01-01  00:00stock_name_A 
2020-01-01  00:00stock_name_B 
2020-01-01  00:00stock_name_C 
2020-01-01  01:00stock_name_A 
2020-01-01  01:00stock_name_B 
2020-01-01  01:00stock_name_C 
2020-01-01  02:00stock_name_A 
2020-01-01  02:00stock_name_B 
2020-01-01  02:00stock_name_C 

 

Labels (3)
0 Karma
1 Solution

CarbonCriterium
Path Finder

I solved this with a workaround that may not be the most "splunkable" solution, but provides the answer results I am looking for. 

|eval splitfield=stocks+"_pct"
|stats sum(eval(flow*100))AS pct BY day_hour splitfield
|table day_hour pct splitfield
|eval {splitfield}=pct
|fields -splitfield,pct
|stats values(*) AS * BY day_hour
|fillnull
|addtotals



View solution in original post

0 Karma

CarbonCriterium
Path Finder

I solved this with a workaround that may not be the most "splunkable" solution, but provides the answer results I am looking for. 

|eval splitfield=stocks+"_pct"
|stats sum(eval(flow*100))AS pct BY day_hour splitfield
|table day_hour pct splitfield
|eval {splitfield}=pct
|fields -splitfield,pct
|stats values(*) AS * BY day_hour
|fillnull
|addtotals



0 Karma

renjith_nair
Legend

Try

| chart sum(eval(flow*100))AS pct over day_hour BY stocks
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

CarbonCriterium
Path Finder

Thank you for your reply @renjith_nair but I am trying to create a table.  The chart command I am using creates the intended format... but the table command does not.  

Do you know why this is happening?

0 Karma

renjith_nair
Legend

Have you tried chart over? What happens when you change visualization to stats/table.

Please find attached .

renjith_nair_0-1602490761419.png

 

 

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| xyseries day_hour stocks pct
0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...