Splunk Search

Why does this chart work, but this table doesn't?

CarbonCriterium
Path Finder

I would like to apply a formula to each of the values in the field "stocks."  I have been able to show this in a chart, but I need it as a table... what is going on here?  

The values in day_hour and stocks are strings.  Flow is a numeric value.  Pct should be a numeric value. 

 

 

| chart sum(eval(flow*100))AS pct BY day_hour stocks

 


The charting command produces the following.  This is how I want my table to look.  

day_hourstock_name_Astock_name_Bstock_name_C
2020-01-01  00:00   
2020-01-01  01:00   
2020-01-01  02:00   

 

Instead, my table looks like this:

day_hourstockspct
2020-01-01  00:00stock_name_A 
2020-01-01  00:00stock_name_B 
2020-01-01  00:00stock_name_C 
2020-01-01  01:00stock_name_A 
2020-01-01  01:00stock_name_B 
2020-01-01  01:00stock_name_C 
2020-01-01  02:00stock_name_A 
2020-01-01  02:00stock_name_B 
2020-01-01  02:00stock_name_C 

 

Labels (3)
0 Karma
1 Solution

CarbonCriterium
Path Finder

I solved this with a workaround that may not be the most "splunkable" solution, but provides the answer results I am looking for. 

|eval splitfield=stocks+"_pct"
|stats sum(eval(flow*100))AS pct BY day_hour splitfield
|table day_hour pct splitfield
|eval {splitfield}=pct
|fields -splitfield,pct
|stats values(*) AS * BY day_hour
|fillnull
|addtotals



View solution in original post

0 Karma

CarbonCriterium
Path Finder

I solved this with a workaround that may not be the most "splunkable" solution, but provides the answer results I am looking for. 

|eval splitfield=stocks+"_pct"
|stats sum(eval(flow*100))AS pct BY day_hour splitfield
|table day_hour pct splitfield
|eval {splitfield}=pct
|fields -splitfield,pct
|stats values(*) AS * BY day_hour
|fillnull
|addtotals



0 Karma

renjith_nair
Legend

Try

| chart sum(eval(flow*100))AS pct over day_hour BY stocks
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

CarbonCriterium
Path Finder

Thank you for your reply @renjith_nair but I am trying to create a table.  The chart command I am using creates the intended format... but the table command does not.  

Do you know why this is happening?

0 Karma

renjith_nair
Legend

Have you tried chart over? What happens when you change visualization to stats/table.

Please find attached .

renjith_nair_0-1602490761419.png

 

 

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| xyseries day_hour stocks pct
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...