Splunk Search

transform command after timechart?

dyeo
Engager

Is it possible to do an eval after using timechart? I want to modify the count values in column A by dividing those values by 10. My query below is not performing the operator on column A.

(index=Wineventlog sourcetype="WinEventLog:security" EventCode=4740 OR (action=failure EventCode=4625 host=eee OR host=xyz) OR (host=asd (EventCode=516 OR EventCode=411) NOT clientIP=10.10.10.10) NOT user="-") OR (index=fff action=failure) 
| eval output=coalesce(userMsg, lockoutUser, user, sAMAccountName) 
| eval descrip=case(EventCode=4625, "A", EventCode=4740, "B", EventCode=411, "C", EventCode=516, D", EventCode="AVEN-FAIL", "E") 
| timechart span=1h dc(output) as count by descrip
|eval count=if(descrip="A", count/10, count)
Tags (3)
0 Karma
1 Solution

adonio
Ultra Champion

quick and dirty 2 steps process will be something like that:

(index=Wineventlog sourcetype="WinEventLog:security" EventCode=4740 OR (action=failure EventCode=4625 host=eee OR host=xyz) OR (host=asd (EventCode=516 OR EventCode=411) NOT clientIP=10.10.10.10) NOT user="-") OR (index=fff action=failure) 
 | eval output=coalesce(userMsg, lockoutUser, user, sAMAccountName) 
 | eval descrip=case(EventCode=4625, "A", EventCode=4740, "B", EventCode=411, "C", EventCode=516, D", EventCode="AVEN-FAIL", "E") 
  | bin span=1h _time
| stats dc(output) as unique_output by descrip _time
| eval unique_output = if(descrip=="A", unique_output/10, unique_output)
 | timechart span=1h sum(unique_output) as tot_count by descrip

hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

quick and dirty 2 steps process will be something like that:

(index=Wineventlog sourcetype="WinEventLog:security" EventCode=4740 OR (action=failure EventCode=4625 host=eee OR host=xyz) OR (host=asd (EventCode=516 OR EventCode=411) NOT clientIP=10.10.10.10) NOT user="-") OR (index=fff action=failure) 
 | eval output=coalesce(userMsg, lockoutUser, user, sAMAccountName) 
 | eval descrip=case(EventCode=4625, "A", EventCode=4740, "B", EventCode=411, "C", EventCode=516, D", EventCode="AVEN-FAIL", "E") 
  | bin span=1h _time
| stats dc(output) as unique_output by descrip _time
| eval unique_output = if(descrip=="A", unique_output/10, unique_output)
 | timechart span=1h sum(unique_output) as tot_count by descrip

hope it helps

0 Karma

dyeo
Engager

Thanks for your help!

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...