Hello All, I have a really simple search, while it works, I'd like to do some operations on that data:     index=xxxx earliest=-2w@w0 latest=@w6@d+24h | timechart span=7d count(response_time)     Output is  2022-03-13                          3,xxx,xxx 2022-03-20                            3,xxx.xxx The deal is, I'd really like to have those seperate outputs as variables like Week1 and Week2. This way I could do some operations to see my sites volume week to week change so I can normalize error data. Hopefully this makes sense. ... View more

Good afternoon Guru's, I just was put into a position to teach myself how to splunk. I don't have experience with this kind of query type language and it's bringing me to my knees. Here's my query...there is a selected index and everything works perfectly except when I add in a simple division statement...then it says the query is malformed but pretty sure that's not the case at all: I'm trying to get the percentage of events that the response_time is greater than 2 standard deviations:   index="myIndex" | eventstats avg(response_time) as Average_Response_Time stdev(response_time) as Standard_Deviation count(response_time) as Total_Count | eval calc = Average_Response_Time+(2*Standard_Deviation) | eval 2xStd = if(response_time>calc, 1, 0) | eventstats sum(2xStd) as 2times | eval percent = 2times/Total_Count | table response_time Average_Response_Time Standard_Deviation ... View more