Why is TimeChart assigning values from spanned table?

[michaelhaedt]

Hello All,

I have a really simple search, while it works, I'd like to do some operations on that data:

index=xxxx

earliest=-2w@w0 latest=@w6@d+24h

| timechart span=7d count(response_time)

Output is 

2022-03-13                          3,xxx,xxx

2022-03-20                            3,xxx.xxx

The deal is, I'd really like to have those seperate outputs as variables like Week1 and Week2. This way I could do some operations to see my sites volume week to week change so I can normalize error data. Hopefully this makes sense.

[VatsalJagani]

Try this:

index=xxx earliest=-2w@w0 latest=@w6@d+24h
| timechart span=7d count(response_time)
| streamstats count as week_num
| eval Week="Week ".week_num | fields - week_num, _time

Kindly accept the answer if it gives resolution.

[michaelhaedt]

So that gives me a very similar output to what I have, which I need to have variables assigned the count(response_time) of each of the weeks. I like how this solution put it into one search and not an appended search though, very clever, I'd love to know how it works.

[VatsalJagani]

With streamstats you can assign the numbers to your results and then with eval I'm just appending that number to "Week ".

This works because proper ordering and missing values of _time series will already be handled by timechart command.

[michaelhaedt]

Thanks for the explanation! I still need a way to assign the counts of Week 1 and 2 to  variables so I can start to manipulate the data.

[VatsalJagani]

Can you please explain by posting your current output and explain what change you are looking for?

[michaelhaedt]

Below is my data: I need to be able to assign the data to a variable like Week1Data = 1160516 and Week2Data = 3488119

This seems really easy, but I don't know how to logically address the data in the table to do an Eval 

1	1160516	Week 1
2	3488119	Week 2

[VatsalJagani · Accepted solution]

Try this query:

index=xxx earliest=-2w@w0 latest=@w6@d+24h
| timechart span=7d count(response_time)
| streamstats count as week_num
| eval Week="Week".week_num | fields - week_num, _time, _span
| transpose header_field="Week"

transpose command should be able to do what you are looking for.