Splunk Search
Highlighted

timechart to display calculated values

Path Finder

Trying to display Percentages on Timechart , but it's not working.

 

Base search | fields APP Usage_kb | eval Usage_gb= round(Usage_kb/1024/1024, 5) | timechart count by APP.

it's not working.

I want to display timechart for Usage_gb per APP.

please help me.

 

 

Labels (6)
0 Karma
Highlighted

Re: timechart to display calculated values

SplunkTrust
SplunkTrust

Pass the eval AFTER the timechart. The eval will do the math on a column by column basis 

 

 

| fields APP Usage_kb

| timechart max(Usage_kb) AS Usage_kb by APP

| eval Usage_gb= round(Usage_kb/1024/1024, 5)

 

0 Karma
Highlighted

Re: timechart to display calculated values

Path Finder

Thankyou, but it's not giving data in Usage_gb , displaying data in Usage_kb only

Tags (1)
0 Karma
Highlighted

Re: timechart to display calculated values

Path Finder

i got it 

basesearch | fields APP Usage_kb | eval Usage_gb = round(Usage_kb/1024/1024, 5) | timechart span = 1d max(Usage_gb) AS Usage_gb by APP.

it's working.

View solution in original post

0 Karma