Splunk Search

timechart to display calculated values

kirrusk
Communicator

Trying to display Percentages on Timechart , but it's not working.

 

Base search | fields APP Usage_kb | eval Usage_gb= round(Usage_kb/1024/1024, 5) | timechart count by APP.

it's not working.

I want to display timechart for Usage_gb per APP.

please help me.

 

 

Labels (6)
0 Karma
1 Solution

kirrusk
Communicator

i got it 

basesearch | fields APP Usage_kb | eval Usage_gb = round(Usage_kb/1024/1024, 5) | timechart span = 1d max(Usage_gb) AS Usage_gb by APP.

it's working.

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Pass the eval AFTER the timechart. The eval will do the math on a column by column basis 

 

 

| fields APP Usage_kb

| timechart max(Usage_kb) AS Usage_kb by APP

| eval Usage_gb= round(Usage_kb/1024/1024, 5)

 

0 Karma

kirrusk
Communicator

Thankyou, but it's not giving data in Usage_gb , displaying data in Usage_kb only

Tags (1)
0 Karma

kirrusk
Communicator

i got it 

basesearch | fields APP Usage_kb | eval Usage_gb = round(Usage_kb/1024/1024, 5) | timechart span = 1d max(Usage_gb) AS Usage_gb by APP.

it's working.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...