Splunk Search

using variables in a search + to store number of rows

HattrickNZ
Motivator

I have a search | timechart span=h count | streamstats count as row
that gives me 24 rows: (1 full day at an hourly level)

_time   count   row
1   2016-02-20 00:00    2   1
2   2016-02-20 01:00    2   2
...
23  2016-02-20 22:00    2   23
24  2016-02-20 23:00    2   24

what I want to do is get a total of the count and then divide this by (NumberOfRows*2)*100

| timechart span=h count | stats sum(count) as total | eval percent=total/24*2*100 which will give me:

total   percent
1   48  100

How do I set NumberOfRows to be a variable storing the number of rows dynamically, 24 for 1 day, or if I do it for 2 days it would be 48 ....etc.
Or is there a better way of doing this?

0 Karma
1 Solution

maciep
Champion

I feel like there's probably a better way to accomplish what you're trying to get after, but it's late and my brain is shutting down. But to answer your question maybe, I think this should work.

| timechart span=h count | stats sum(count) as total dc(_time) as numRows | eval percent=total/numRows*2*100

that should get you the distinct count of values for _time, which after the timechart should be one for each row.

View solution in original post

maciep
Champion

I feel like there's probably a better way to accomplish what you're trying to get after, but it's late and my brain is shutting down. But to answer your question maybe, I think this should work.

| timechart span=h count | stats sum(count) as total dc(_time) as numRows | eval percent=total/numRows*2*100

that should get you the distinct count of values for _time, which after the timechart should be one for each row.

HattrickNZ
Motivator

tks, | timechart span=h count | stats sum(count) as total dc(_time) as numRows | eval percent=total/(numRows*2)*100 just had to add the brackets.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...