Splunk Search

timechart to display calculated values

kirrusk
Communicator

Trying to display Percentages on Timechart , but it's not working.

 

Base search | fields APP Usage_kb | eval Usage_gb= round(Usage_kb/1024/1024, 5) | timechart count by APP.

it's not working.

I want to display timechart for Usage_gb per APP.

please help me.

 

 

Labels (6)
0 Karma
1 Solution

kirrusk
Communicator

i got it 

basesearch | fields APP Usage_kb | eval Usage_gb = round(Usage_kb/1024/1024, 5) | timechart span = 1d max(Usage_gb) AS Usage_gb by APP.

it's working.

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Pass the eval AFTER the timechart. The eval will do the math on a column by column basis 

 

 

| fields APP Usage_kb

| timechart max(Usage_kb) AS Usage_kb by APP

| eval Usage_gb= round(Usage_kb/1024/1024, 5)

 

0 Karma

kirrusk
Communicator

Thankyou, but it's not giving data in Usage_gb , displaying data in Usage_kb only

Tags (1)
0 Karma

kirrusk
Communicator

i got it 

basesearch | fields APP Usage_kb | eval Usage_gb = round(Usage_kb/1024/1024, 5) | timechart span = 1d max(Usage_gb) AS Usage_gb by APP.

it's working.

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...