Splunk Search

Why does this chart work, but this table doesn't?

CarbonCriterium
Path Finder

I would like to apply a formula to each of the values in the field "stocks."  I have been able to show this in a chart, but I need it as a table... what is going on here?  

The values in day_hour and stocks are strings.  Flow is a numeric value.  Pct should be a numeric value. 

 

 

| chart sum(eval(flow*100))AS pct BY day_hour stocks

 


The charting command produces the following.  This is how I want my table to look.  

day_hourstock_name_Astock_name_Bstock_name_C
2020-01-01  00:00   
2020-01-01  01:00   
2020-01-01  02:00   

 

Instead, my table looks like this:

day_hourstockspct
2020-01-01  00:00stock_name_A 
2020-01-01  00:00stock_name_B 
2020-01-01  00:00stock_name_C 
2020-01-01  01:00stock_name_A 
2020-01-01  01:00stock_name_B 
2020-01-01  01:00stock_name_C 
2020-01-01  02:00stock_name_A 
2020-01-01  02:00stock_name_B 
2020-01-01  02:00stock_name_C 

 

Labels (3)
0 Karma
1 Solution

CarbonCriterium
Path Finder

I solved this with a workaround that may not be the most "splunkable" solution, but provides the answer results I am looking for. 

|eval splitfield=stocks+"_pct"
|stats sum(eval(flow*100))AS pct BY day_hour splitfield
|table day_hour pct splitfield
|eval {splitfield}=pct
|fields -splitfield,pct
|stats values(*) AS * BY day_hour
|fillnull
|addtotals



View solution in original post

0 Karma

CarbonCriterium
Path Finder

I solved this with a workaround that may not be the most "splunkable" solution, but provides the answer results I am looking for. 

|eval splitfield=stocks+"_pct"
|stats sum(eval(flow*100))AS pct BY day_hour splitfield
|table day_hour pct splitfield
|eval {splitfield}=pct
|fields -splitfield,pct
|stats values(*) AS * BY day_hour
|fillnull
|addtotals



0 Karma

renjith_nair
Legend

Try

| chart sum(eval(flow*100))AS pct over day_hour BY stocks
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

CarbonCriterium
Path Finder

Thank you for your reply @renjith_nair but I am trying to create a table.  The chart command I am using creates the intended format... but the table command does not.  

Do you know why this is happening?

0 Karma

renjith_nair
Legend

Have you tried chart over? What happens when you change visualization to stats/table.

Please find attached .

renjith_nair_0-1602490761419.png

 

 

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| xyseries day_hour stocks pct
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...