Splunk Search

adding results from top query

snookerfly
New Member

Hi,

I've got a result table from a top query and want to add the results to compute an overall cache hit rate and feed this into either a time chart or pie chart for a dashboard.

Example:
action count percent
TCP_MISS 16438 55.479429
UDP_MISS 10627 35.866887
TCP_REFRESH_UNMODIFIED 797 2.689932
TCP_HIT 527 1.778663
TCP_MEM_HIT 487 1.64366
TCP_IMS_HIT 375 1.265652
TCP_REFRESH_MODIFIED 157 0.529886
TCP_MISS_ABORTED 143 0.482635
TCP_CLIENT_REFRESH_MISS 74 0.249755
TCP_HIT_ABORTED 2 0.00675

Add all numbers from the percent column that have either "HIT" or "UNMODIFIED" in the action column and feed this number to a pie or time chart.

Tags (4)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

How 'bout this?

your base search before the top call | eval cache_hit = if(match(action, "HIT|UNMODIFIED"), "hit", "miss") | top cache_hit

Feed that into a pie chart.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

How 'bout this?

your base search before the top call | eval cache_hit = if(match(action, "HIT|UNMODIFIED"), "hit", "miss") | top cache_hit

Feed that into a pie chart.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...