Splunk Search

Why does this chart work, but this table doesn't?

CarbonCriterium
Path Finder

I would like to apply a formula to each of the values in the field "stocks."  I have been able to show this in a chart, but I need it as a table... what is going on here?  

The values in day_hour and stocks are strings.  Flow is a numeric value.  Pct should be a numeric value. 

 

 

| chart sum(eval(flow*100))AS pct BY day_hour stocks

 


The charting command produces the following.  This is how I want my table to look.  

day_hourstock_name_Astock_name_Bstock_name_C
2020-01-01  00:00   
2020-01-01  01:00   
2020-01-01  02:00   

 

Instead, my table looks like this:

day_hourstockspct
2020-01-01  00:00stock_name_A 
2020-01-01  00:00stock_name_B 
2020-01-01  00:00stock_name_C 
2020-01-01  01:00stock_name_A 
2020-01-01  01:00stock_name_B 
2020-01-01  01:00stock_name_C 
2020-01-01  02:00stock_name_A 
2020-01-01  02:00stock_name_B 
2020-01-01  02:00stock_name_C 

 

Labels (3)
0 Karma
1 Solution

CarbonCriterium
Path Finder

I solved this with a workaround that may not be the most "splunkable" solution, but provides the answer results I am looking for. 

|eval splitfield=stocks+"_pct"
|stats sum(eval(flow*100))AS pct BY day_hour splitfield
|table day_hour pct splitfield
|eval {splitfield}=pct
|fields -splitfield,pct
|stats values(*) AS * BY day_hour
|fillnull
|addtotals



View solution in original post

0 Karma

CarbonCriterium
Path Finder

I solved this with a workaround that may not be the most "splunkable" solution, but provides the answer results I am looking for. 

|eval splitfield=stocks+"_pct"
|stats sum(eval(flow*100))AS pct BY day_hour splitfield
|table day_hour pct splitfield
|eval {splitfield}=pct
|fields -splitfield,pct
|stats values(*) AS * BY day_hour
|fillnull
|addtotals



View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Try

| chart sum(eval(flow*100))AS pct over day_hour BY stocks
0 Karma

CarbonCriterium
Path Finder

Thank you for your reply @renjith_nair but I am trying to create a table.  The chart command I am using creates the intended format... but the table command does not.  

Do you know why this is happening?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Have you tried chart over? What happens when you change visualization to stats/table.

Please find attached .

renjith_nair_0-1602490761419.png

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| xyseries day_hour stocks pct
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!