Splunk Search

timechart ratio by model

sarathipattam
New Member

Hi,

below is my query

index_ sourcetype=main
| stats count(eval(level="Error")) as ERRORS count(eval(level="Information")) as USAGE by Model osVersion firmware
|eval RATE=round(((EXCEEDED/REQUEST)*100),1)

and I want to time chart the ratio by this three coloums/dimensions Model, osVersion, firmware.

Can someone assist me please?

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

I'm assuming there is a typo in the field names in the eval for RATE field (should be ERRORS/USAGE), so using the correct names, try like this (whatever timespan you want to use for time chart, update the same in bin and timechart command, below uses timespan of 1h or 1 hour)

index_ sourcetype=main
| bin span=1h _time
| stats count(eval(level="Error")) as ERRORS count(eval(level="Information")) as USAGE by _time Model osVersion firmware
|eval RATE=round(((ERRORS/USAGE)*100),1)
| eval Model_osVersion_firmware=Model."/".osVersion."/".firmware
| timechart span=1h avg(RATE) by Model_osVersion_firmware

View solution in original post

0 Karma

sarathipattam
New Member

concatenate is not working for me

0 Karma

sarathipattam
New Member

i used strcat and it worked.. thank you!!

0 Karma

somesoni2
Revered Legend

I'm assuming there is a typo in the field names in the eval for RATE field (should be ERRORS/USAGE), so using the correct names, try like this (whatever timespan you want to use for time chart, update the same in bin and timechart command, below uses timespan of 1h or 1 hour)

index_ sourcetype=main
| bin span=1h _time
| stats count(eval(level="Error")) as ERRORS count(eval(level="Information")) as USAGE by _time Model osVersion firmware
|eval RATE=round(((ERRORS/USAGE)*100),1)
| eval Model_osVersion_firmware=Model."/".osVersion."/".firmware
| timechart span=1h avg(RATE) by Model_osVersion_firmware

View solution in original post

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!