Splunk Search

eval and timechart

sphiwee
Contributor

How can I get STP as a bar chart ? im getting error when i try to do it like this

 

sphiwee_0-1624211848747.png

 

i want to display STP for each month

Labels (2)
0 Karma

sphiwee
Contributor

here's the spl query

index="acoe_np_spa_metrics"| search Project="*" AND Volume="*" |bin _time span=1month | stats
count(eval(D_Status="F")) as success_count
count(eval(D_Status="S")) as failure_count | eval TOTAL_COUNT=(success_count + failure_count) | eval STP=(success_count/TOTAL_COUNT)*100 | timechart STP

Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

There's no need to use stats/bin, you can do it all with timechart and post calculations.

index="acoe_np_spa_metrics"
| search Project="*" AND Volume="*" 
| timechart span=1mon count(eval(D_Status="F")) as success_count
  count(eval(D_Status="S")) as failure_count count as Total
| eval STP=(success_count/Total)*100 
| fields - Total 

So generate the timechart and include the Total count per month also, then just calculate the success percentage at the end and then remove the Total field if you don't want it.

Note that this assumes Total will be the same as success+failure - if not, then calculate Total afterwards instead.

 

sphiwee
Contributor

Thanks it works, but seems I actually had to get the sum of the volume where D_status = F and sum of volume where D_Status = S... 

How can I achieve this?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

If you want to get the total success/failure counts not split by month then just add an eventstats at the end

| eventstats sum(success_count) as total_success_count sum(failure_count) as total_failure_count

is that what you are after?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...