I would like to apply a formula to each of the values in the field "stocks." I have been able to show this in a chart, but I need it as a table... what is going on here?
The values in day_hour and stocks are strings. Flow is a numeric value. Pct should be a numeric value.
| chart sum(eval(flow*100))AS pct BY day_hour stocks
The charting command produces the following. This is how I want my table to look.
day_hour | stock_name_A | stock_name_B | stock_name_C |
2020-01-01 00:00 | |||
2020-01-01 01:00 | |||
2020-01-01 02:00 |
Instead, my table looks like this:
day_hour | stocks | pct |
2020-01-01 00:00 | stock_name_A | |
2020-01-01 00:00 | stock_name_B | |
2020-01-01 00:00 | stock_name_C | |
2020-01-01 01:00 | stock_name_A | |
2020-01-01 01:00 | stock_name_B | |
2020-01-01 01:00 | stock_name_C | |
2020-01-01 02:00 | stock_name_A | |
2020-01-01 02:00 | stock_name_B | |
2020-01-01 02:00 | stock_name_C |
I solved this with a workaround that may not be the most "splunkable" solution, but provides the answer results I am looking for.
|eval splitfield=stocks+"_pct"
|stats sum(eval(flow*100))AS pct BY day_hour splitfield
|table day_hour pct splitfield
|eval {splitfield}=pct
|fields -splitfield,pct
|stats values(*) AS * BY day_hour
|fillnull
|addtotals
I solved this with a workaround that may not be the most "splunkable" solution, but provides the answer results I am looking for.
|eval splitfield=stocks+"_pct"
|stats sum(eval(flow*100))AS pct BY day_hour splitfield
|table day_hour pct splitfield
|eval {splitfield}=pct
|fields -splitfield,pct
|stats values(*) AS * BY day_hour
|fillnull
|addtotals
Try
| chart sum(eval(flow*100))AS pct over day_hour BY stocks
Thank you for your reply @renjith_nair but I am trying to create a table. The chart command I am using creates the intended format... but the table command does not.
Do you know why this is happening?
Have you tried chart over? What happens when you change visualization to stats/table.
Please find attached .
| xyseries day_hour stocks pct