Hi.
I'm triying to correlate in a time chart number of visits with average response time but time is in milisecons and visits in thousands, so y want to aply a factor to count thousands instead of visits, but seems I can not apply directly to a count. I also tried to eval it previously but still getting invalid command.
so how do I apply a factor to a count in order to reduce its magnitude for a timechart? I'm using splunkstorm
Try this workaround. Assumming your original query is like this (giving count in 1000's and you want to apply a factor fct to reduce the magnitude of values.
Orig:
index=XX sourcetype=YY | timechart span=NN count by somefield
Updated:
index=XX sourcetype=YY | bucket span=NN _time | stats count by somefield,_time | timechart sum(eval(count/fct)) as count by somefield | makecontinous _time span=NN
Try this workaround. Assumming your original query is like this (giving count in 1000's and you want to apply a factor fct to reduce the magnitude of values.
Orig:
index=XX sourcetype=YY | timechart span=NN count by somefield
Updated:
index=XX sourcetype=YY | bucket span=NN _time | stats count by somefield,_time | timechart sum(eval(count/fct)) as count by somefield | makecontinous _time span=NN
How did you try eval? That's probably how you would achieve this.