Splunk Search

How to timechart several eval commands in one search?

naty
Path Finder

Hi,

i am doing a search with append and i am trying to optimize it.
this is my search:

index=myind source=mysrc POOL_ID=id  | eval TOTAL_RATE=(READ_XFER_RATE + WRITE_XFER_RATE)/1024 | eval ReportKey="Total Transfer" | append [search index=myind source=mysrc POOL_ID=id | eval TOTAL_RATE=READ_XFER_RATE/1024 | eval ReportKey="Read Transfer" | append [search index=myind source=mysrc POOL_ID=id | eval TOTAL_RATE=WRITE_XFER_RATE/1024 | eval ReportKey="Write Transfer"]] | timechart span=1m max(TOTAL_RATE) by ReportKey

my problem is with all the appends, it's not very good.
i already get all the data i need in the first search, why do it again? 😛

so i want to do something like this:

index=myind source=mysrc POOL_ID=id | eval TOTAL_RATE=(READ_XFER_RATE + WRITE_XFER_RATE)/1024 | eval TOTAL_READ=READ_XFER_RATE/1024 | eval TOTAL_WRITE=WRITE_XFER_RATE/1024

the next thing i want is to pair each eval with a name, like this:

eval TOTAL_RATE=(READ_XFER_RATE + WRITE_XFER_RATE)/1024 "Total Transfer" | eval TOTAL_READ=READ_XFER_RATE/1024 "Read Transfer" | eval TOTAL_WRITE=WRITE_XFER_RATE "Write Transfer"

and in the end do a timechart for each eval by its label.

so in the end, the search should be in this mindset:

index=myind source=mysrc POOL_ID=id | eval TOTAL_RATE=(READ_RESPONSE_RATE + WRITE_RESPONSE_RATE)/2/1000 | eval TOTAL_READ=READ_RESPONSE_RATE/1000 | eval TOTAL_WRITE=WRITE_RESPONSE_RATE | table _time,TOTAL_RATE,TOTAL_WRITE,TOTAL_READ | 

is it possible?
if so, how to make the magic happen?

Thank you!

0 Karma

somesoni2
Revered Legend

You were almost there. Try like this

index=myind source=mysrc POOL_ID=id | eval TOTAL_RATE=(READ_XFER_RATE + WRITE_XFER_RATE)/1024 | eval TOTAL_READ=READ_XFER_RATE/1024 | eval TOTAL_WRITE=WRITE_XFER_RATE/1024
| timechart span=1m max(TOTAL_RATE) as "Total Transfer" max(TOTAL_READ) as  "Read Transfer"  max(TOTAL_WRITE) as  "Write Transfer"
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...