- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- timechart ratio by model
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
below is my query
index_ sourcetype=main
| stats count(eval(level="Error")) as ERRORS count(eval(level="Information")) as USAGE by Model osVersion firmware
|eval RATE=round(((EXCEEDED/REQUEST)*100),1)
and I want to time chart the ratio by this three coloums/dimensions Model, osVersion, firmware.
Can someone assist me please?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm assuming there is a typo in the field names in the eval for RATE field (should be ERRORS/USAGE), so using the correct names, try like this (whatever timespan you want to use for time chart, update the same in bin and timechart command, below uses timespan of 1h or 1 hour)
index_ sourcetype=main
| bin span=1h _time
| stats count(eval(level="Error")) as ERRORS count(eval(level="Information")) as USAGE by _time Model osVersion firmware
|eval RATE=round(((ERRORS/USAGE)*100),1)
| eval Model_osVersion_firmware=Model."/".osVersion."/".firmware
| timechart span=1h avg(RATE) by Model_osVersion_firmware
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
concatenate is not working for me
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i used strcat and it worked.. thank you!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm assuming there is a typo in the field names in the eval for RATE field (should be ERRORS/USAGE), so using the correct names, try like this (whatever timespan you want to use for time chart, update the same in bin and timechart command, below uses timespan of 1h or 1 hour)
index_ sourcetype=main
| bin span=1h _time
| stats count(eval(level="Error")) as ERRORS count(eval(level="Information")) as USAGE by _time Model osVersion firmware
|eval RATE=round(((ERRORS/USAGE)*100),1)
| eval Model_osVersion_firmware=Model."/".osVersion."/".firmware
| timechart span=1h avg(RATE) by Model_osVersion_firmware
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
