Splunk Search

How do I represent an Eval result with timechart?

rafasalo
Engager

Hi,

With the support of Splunk's community, I have this search below. However, right now I would like to take the result and use the timechart command so I can see each hour. How do I do this?

index= "index_cbo_pt" "AcquirerResponseCode=0" | stats count as Result1 | appendcols [search index= "index_cbo_pt" "AcquirerResponseCode=0" | stats dc(MerchantCheckoutId) as Result2] | eval finalValue = Result1/Result2 | table finalValue Result1 Result2

Can somebody help me?

0 Karma
1 Solution

polymorphic
Communicator

Im not sure why you want to do the 'appencols' in this search.

This should be the solution:

index=index_cbo_pt AcquirerResponseCode=0
 | timechart span=1h count as Result1 dc(MerchantCheckoutId) as Result2
 | eval finalValue = Result1/Result2
 | fields _time finalValue Result1 Result2

Try it out.

View solution in original post

0 Karma

javiergn
SplunkTrust
SplunkTrust

Timechart requires a timestamp so remove the table line and use

timechart list(finalValue) WHATEVEROTHERPARAMETERSYOUWANT
0 Karma

rafasalo
Engager

I've tried the query bellow and haven't worked.

index= "index_cbo_pt" "AcquirerResponseCode=0" | stats count as Result1 | appendcols [search index= "index_cbo_pt" "AcquirerResponseCode=0" | stats dc(MerchantCheckoutId) as Result2] | eval finalValue = Result1/Result2 | timechart list(finalValue) count

thanks!

0 Karma

javiergn
SplunkTrust
SplunkTrust

You don't need the last 'count'. Simply define a span and let the list represent all your values

polymorphic
Communicator

Im not sure why you want to do the 'appencols' in this search.

This should be the solution:

index=index_cbo_pt AcquirerResponseCode=0
 | timechart span=1h count as Result1 dc(MerchantCheckoutId) as Result2
 | eval finalValue = Result1/Result2
 | fields _time finalValue Result1 Result2

Try it out.

0 Karma

rafasalo
Engager

Thank your! It works!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...