Splunk Search

eval and timechart

sphiwee
Contributor

How can I get STP as a bar chart ? im getting error when i try to do it like this

 

sphiwee_0-1624211848747.png

 

i want to display STP for each month

Labels (2)
0 Karma

sphiwee
Contributor

here's the spl query

index="acoe_np_spa_metrics"| search Project="*" AND Volume="*" |bin _time span=1month | stats
count(eval(D_Status="F")) as success_count
count(eval(D_Status="S")) as failure_count | eval TOTAL_COUNT=(success_count + failure_count) | eval STP=(success_count/TOTAL_COUNT)*100 | timechart STP

Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

There's no need to use stats/bin, you can do it all with timechart and post calculations.

index="acoe_np_spa_metrics"
| search Project="*" AND Volume="*" 
| timechart span=1mon count(eval(D_Status="F")) as success_count
  count(eval(D_Status="S")) as failure_count count as Total
| eval STP=(success_count/Total)*100 
| fields - Total 

So generate the timechart and include the Total count per month also, then just calculate the success percentage at the end and then remove the Total field if you don't want it.

Note that this assumes Total will be the same as success+failure - if not, then calculate Total afterwards instead.

 

sphiwee
Contributor

Thanks it works, but seems I actually had to get the sum of the volume where D_status = F and sum of volume where D_Status = S... 

How can I achieve this?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

If you want to get the total success/failure counts not split by month then just add an eventstats at the end

| eventstats sum(success_count) as total_success_count sum(failure_count) as total_failure_count

is that what you are after?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...