how to add calculation result of timechart

[Richard_400]

Hello,

I'm trying to new chart as calculate through packet count.

I search with query for interface for several device.

I could show as follow.

_time	interface-A	Interface-B	interface-C
9:00	100	200	100
9:10	150	250	100
9:20	200	300	100

I would like add Interface A+B-C for column as follow

_time	interface-A	Interface-B	interface-C	Interface A+B-C
9:00	100	200	100	200
9:10	150	250	100	300
9:20	200	300	100	400

How can I make it?

[gcusello · Accepted solution]

Hi @Richard_400 ,

run something like the following

<your_search>
| bin span=10m _time
| chart count OVER interface BY _time
| eval 'Interface A+B-C'='interface-A'+'Interface-B'-'interface-C'

in general, don't use the minus in the fied names because Splunk knows it as minus, so you need to use quotes for the field names, use underscore (_).

Ciao.

Giuseppe

[Richard_400]

Hi @gcusello ,

Thank you for your feedback.

I got expecting work.

BR