Splunk Search

transform command after timechart?

dyeo
Engager

Is it possible to do an eval after using timechart? I want to modify the count values in column A by dividing those values by 10. My query below is not performing the operator on column A.

(index=Wineventlog sourcetype="WinEventLog:security" EventCode=4740 OR (action=failure EventCode=4625 host=eee OR host=xyz) OR (host=asd (EventCode=516 OR EventCode=411) NOT clientIP=10.10.10.10) NOT user="-") OR (index=fff action=failure) 
| eval output=coalesce(userMsg, lockoutUser, user, sAMAccountName) 
| eval descrip=case(EventCode=4625, "A", EventCode=4740, "B", EventCode=411, "C", EventCode=516, D", EventCode="AVEN-FAIL", "E") 
| timechart span=1h dc(output) as count by descrip
|eval count=if(descrip="A", count/10, count)
Tags (3)
0 Karma
1 Solution

adonio
SplunkTrust
SplunkTrust

quick and dirty 2 steps process will be something like that:

(index=Wineventlog sourcetype="WinEventLog:security" EventCode=4740 OR (action=failure EventCode=4625 host=eee OR host=xyz) OR (host=asd (EventCode=516 OR EventCode=411) NOT clientIP=10.10.10.10) NOT user="-") OR (index=fff action=failure) 
 | eval output=coalesce(userMsg, lockoutUser, user, sAMAccountName) 
 | eval descrip=case(EventCode=4625, "A", EventCode=4740, "B", EventCode=411, "C", EventCode=516, D", EventCode="AVEN-FAIL", "E") 
  | bin span=1h _time
| stats dc(output) as unique_output by descrip _time
| eval unique_output = if(descrip=="A", unique_output/10, unique_output)
 | timechart span=1h sum(unique_output) as tot_count by descrip

hope it helps

View solution in original post

0 Karma

adonio
SplunkTrust
SplunkTrust

quick and dirty 2 steps process will be something like that:

(index=Wineventlog sourcetype="WinEventLog:security" EventCode=4740 OR (action=failure EventCode=4625 host=eee OR host=xyz) OR (host=asd (EventCode=516 OR EventCode=411) NOT clientIP=10.10.10.10) NOT user="-") OR (index=fff action=failure) 
 | eval output=coalesce(userMsg, lockoutUser, user, sAMAccountName) 
 | eval descrip=case(EventCode=4625, "A", EventCode=4740, "B", EventCode=411, "C", EventCode=516, D", EventCode="AVEN-FAIL", "E") 
  | bin span=1h _time
| stats dc(output) as unique_output by descrip _time
| eval unique_output = if(descrip=="A", unique_output/10, unique_output)
 | timechart span=1h sum(unique_output) as tot_count by descrip

hope it helps

View solution in original post

0 Karma

dyeo
Engager

Thanks for your help!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!