Splunk Search

Why does this chart work, but this table doesn't?

CarbonCriterium
Path Finder

I would like to apply a formula to each of the values in the field "stocks."  I have been able to show this in a chart, but I need it as a table... what is going on here?  

The values in day_hour and stocks are strings.  Flow is a numeric value.  Pct should be a numeric value. 

 

 

| chart sum(eval(flow*100))AS pct BY day_hour stocks

 


The charting command produces the following.  This is how I want my table to look.  

day_hourstock_name_Astock_name_Bstock_name_C
2020-01-01  00:00   
2020-01-01  01:00   
2020-01-01  02:00   

 

Instead, my table looks like this:

day_hourstockspct
2020-01-01  00:00stock_name_A 
2020-01-01  00:00stock_name_B 
2020-01-01  00:00stock_name_C 
2020-01-01  01:00stock_name_A 
2020-01-01  01:00stock_name_B 
2020-01-01  01:00stock_name_C 
2020-01-01  02:00stock_name_A 
2020-01-01  02:00stock_name_B 
2020-01-01  02:00stock_name_C 

 

Labels (3)
0 Karma
1 Solution

CarbonCriterium
Path Finder

I solved this with a workaround that may not be the most "splunkable" solution, but provides the answer results I am looking for. 

|eval splitfield=stocks+"_pct"
|stats sum(eval(flow*100))AS pct BY day_hour splitfield
|table day_hour pct splitfield
|eval {splitfield}=pct
|fields -splitfield,pct
|stats values(*) AS * BY day_hour
|fillnull
|addtotals



View solution in original post

0 Karma

CarbonCriterium
Path Finder

I solved this with a workaround that may not be the most "splunkable" solution, but provides the answer results I am looking for. 

|eval splitfield=stocks+"_pct"
|stats sum(eval(flow*100))AS pct BY day_hour splitfield
|table day_hour pct splitfield
|eval {splitfield}=pct
|fields -splitfield,pct
|stats values(*) AS * BY day_hour
|fillnull
|addtotals



0 Karma

renjith_nair
Legend

Try

| chart sum(eval(flow*100))AS pct over day_hour BY stocks
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

CarbonCriterium
Path Finder

Thank you for your reply @renjith_nair but I am trying to create a table.  The chart command I am using creates the intended format... but the table command does not.  

Do you know why this is happening?

0 Karma

renjith_nair
Legend

Have you tried chart over? What happens when you change visualization to stats/table.

Please find attached .

renjith_nair_0-1602490761419.png

 

 

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| xyseries day_hour stocks pct
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...