Splunk Search

transform command after timechart?

dyeo
Engager

Is it possible to do an eval after using timechart? I want to modify the count values in column A by dividing those values by 10. My query below is not performing the operator on column A.

(index=Wineventlog sourcetype="WinEventLog:security" EventCode=4740 OR (action=failure EventCode=4625 host=eee OR host=xyz) OR (host=asd (EventCode=516 OR EventCode=411) NOT clientIP=10.10.10.10) NOT user="-") OR (index=fff action=failure) 
| eval output=coalesce(userMsg, lockoutUser, user, sAMAccountName) 
| eval descrip=case(EventCode=4625, "A", EventCode=4740, "B", EventCode=411, "C", EventCode=516, D", EventCode="AVEN-FAIL", "E") 
| timechart span=1h dc(output) as count by descrip
|eval count=if(descrip="A", count/10, count)
Tags (3)
0 Karma
1 Solution

adonio
Ultra Champion

quick and dirty 2 steps process will be something like that:

(index=Wineventlog sourcetype="WinEventLog:security" EventCode=4740 OR (action=failure EventCode=4625 host=eee OR host=xyz) OR (host=asd (EventCode=516 OR EventCode=411) NOT clientIP=10.10.10.10) NOT user="-") OR (index=fff action=failure) 
 | eval output=coalesce(userMsg, lockoutUser, user, sAMAccountName) 
 | eval descrip=case(EventCode=4625, "A", EventCode=4740, "B", EventCode=411, "C", EventCode=516, D", EventCode="AVEN-FAIL", "E") 
  | bin span=1h _time
| stats dc(output) as unique_output by descrip _time
| eval unique_output = if(descrip=="A", unique_output/10, unique_output)
 | timechart span=1h sum(unique_output) as tot_count by descrip

hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

quick and dirty 2 steps process will be something like that:

(index=Wineventlog sourcetype="WinEventLog:security" EventCode=4740 OR (action=failure EventCode=4625 host=eee OR host=xyz) OR (host=asd (EventCode=516 OR EventCode=411) NOT clientIP=10.10.10.10) NOT user="-") OR (index=fff action=failure) 
 | eval output=coalesce(userMsg, lockoutUser, user, sAMAccountName) 
 | eval descrip=case(EventCode=4625, "A", EventCode=4740, "B", EventCode=411, "C", EventCode=516, D", EventCode="AVEN-FAIL", "E") 
  | bin span=1h _time
| stats dc(output) as unique_output by descrip _time
| eval unique_output = if(descrip=="A", unique_output/10, unique_output)
 | timechart span=1h sum(unique_output) as tot_count by descrip

hope it helps

0 Karma

dyeo
Engager

Thanks for your help!

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...