Splunk Search

using variables in a search + to store number of rows

HattrickNZ
Motivator

I have a search | timechart span=h count | streamstats count as row
that gives me 24 rows: (1 full day at an hourly level)

_time   count   row
1   2016-02-20 00:00    2   1
2   2016-02-20 01:00    2   2
...
23  2016-02-20 22:00    2   23
24  2016-02-20 23:00    2   24

what I want to do is get a total of the count and then divide this by (NumberOfRows*2)*100

| timechart span=h count | stats sum(count) as total | eval percent=total/24*2*100 which will give me:

total   percent
1   48  100

How do I set NumberOfRows to be a variable storing the number of rows dynamically, 24 for 1 day, or if I do it for 2 days it would be 48 ....etc.
Or is there a better way of doing this?

0 Karma
1 Solution

maciep
Champion

I feel like there's probably a better way to accomplish what you're trying to get after, but it's late and my brain is shutting down. But to answer your question maybe, I think this should work.

| timechart span=h count | stats sum(count) as total dc(_time) as numRows | eval percent=total/numRows*2*100

that should get you the distinct count of values for _time, which after the timechart should be one for each row.

View solution in original post

maciep
Champion

I feel like there's probably a better way to accomplish what you're trying to get after, but it's late and my brain is shutting down. But to answer your question maybe, I think this should work.

| timechart span=h count | stats sum(count) as total dc(_time) as numRows | eval percent=total/numRows*2*100

that should get you the distinct count of values for _time, which after the timechart should be one for each row.

HattrickNZ
Motivator

tks, | timechart span=h count | stats sum(count) as total dc(_time) as numRows | eval percent=total/(numRows*2)*100 just had to add the brackets.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...