Splunk Search

timechart question

dbautist
Explorer

In the timechart docs, the following example was provided:

sourcetype=access_* | timechart count(eval(method="GET")) AS GET, count(eval(method="POST")) AS POST

What if I want to calculate the GetPercentage such that

eval GetPercentage=(GET/(GET+SUCCESS) * 100)

and have that displayed in the timechart? The result should be something like:

_time GetPercentage
1/6/2013 34.5
1/7/2013 22.5

Tags (2)
0 Karma

Ayn
Legend

You can do this by adding your eval after the timechart command.

sourcetype=access_* | timechart count(eval(method="GET")) AS GET, count(eval(method="POST")) AS POST | eval GetPercentage=(GET/(GET+SUCCESS) * 100)

dbautist
Explorer

Thanks! I also want to get a timechart of the GetPercentage by API. I don't want the GET or POST to show because I want to later create a line chart with just the GetPercentage by API. I started with the following but I can't insert the 'by API' in the eval clause:

sourcetype=access_* | timechart count(eval(method="GET")) AS GET, count(eval(method="POST")) AS POST | eval GetPercentage=(GET/(GET+SUCCESS) * 100) | fields - GET, POST

Expected output is something like:
_time getCustomerName(GetPercentage) getCustomerAge(GetPercentage)
1/6/2013 34.5 22.9
1/7/2013 22.5 33.7

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...