Splunk Search

adding results from top query

New Member

Hi,

I've got a result table from a top query and want to add the results to compute an overall cache hit rate and feed this into either a time chart or pie chart for a dashboard.

Example:
action count percent
TCPMISS 16438 55.479429
UDP
MISS 10627 35.866887
TCPREFRESHUNMODIFIED 797 2.689932
TCPHIT 527 1.778663
TCP
MEMHIT 487 1.64366
TCP
IMSHIT 375 1.265652
TCP
REFRESHMODIFIED 157 0.529886
TCP
MISSABORTED 143 0.482635
TCP
CLIENTREFRESHMISS 74 0.249755
TCPHITABORTED 2 0.00675

Add all numbers from the percent column that have either "HIT" or "UNMODIFIED" in the action column and feed this number to a pie or time chart.

Tags (4)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

How 'bout this?

your base search before the top call | eval cache_hit = if(match(action, "HIT|UNMODIFIED"), "hit", "miss") | top cache_hit

Feed that into a pie chart.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

How 'bout this?

your base search before the top call | eval cache_hit = if(match(action, "HIT|UNMODIFIED"), "hit", "miss") | top cache_hit

Feed that into a pie chart.

View solution in original post

0 Karma