Splunk Search

Divide Time Chart Results by 2

kmccowen
Path Finder
index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appnodes/PrefComm-API-Space/*/log/bwappnode*.log"  MessageType != "NULL" | timechart span=1d count by MessageType limit=0

I've tried to eval my counts of several different message types by 2 but it's not working. Any suggestions? I've worked around this issue by using a stats count instead of a timechart but I would like to figure this out within a timechart.

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

I have 2 answers.

This is how you can achieve the same thing:

index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appnodes/PrefComm-API-Space/*/log/bwappnode*.log"  MessageType != "NULL" | timechart span=1d count by MessageType limit=0 | foreach * [eval <<FIELD>> = if((isnum($<<FIELD>>$)), $<<FIELD>>$/2, $<<FIELD>>$)]

This is how you can do exactly what you asked:

index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appnodes/PrefComm-API-Space/*/log/bwappnode*.log"  MessageType != "NULL" | eval half=1/2 | timechart span=1d sum(half) by MessageType limit=0

View solution in original post

kmccowen
Path Finder

This is what I ended up doing but I want to time chart instead.

index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appnodes/PrefComm-API-Space/*/log/bwappnode*.log"  MessageType = "PostCommunicationContact" OR MessageType="GetCommunicationContactsRequest" OR MessageType="charter.enterprise.deletecontactpoints.request" OR MessageType="charter.enterprise.SaveContactDataByValue.request" OR MessageType="charter.enterprise.findEventCommunicationByApplicationIdAndServiceEventId.request" OR MessageType="charter.enterprise.findUIEventFamilyByApplicationID.request" OR MessageType="charter.enterprise.findContactsByAccountNumberAndBillingSystem.request" OR MessageType="charter.enterprise.getcommpreference.request" OR MessageType="charter.enterprise.getcontactpoints.request" OR MessageType="charter.enterprise.savecommpreference.request" OR MessageType="charter.enterprise.deletecommpreference.request" | stats count by MessageType  | eval count=count/2 | eval count=round(count)
0 Karma

woodcock
Esteemed Legend

I have 2 answers.

This is how you can achieve the same thing:

index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appnodes/PrefComm-API-Space/*/log/bwappnode*.log"  MessageType != "NULL" | timechart span=1d count by MessageType limit=0 | foreach * [eval <<FIELD>> = if((isnum($<<FIELD>>$)), $<<FIELD>>$/2, $<<FIELD>>$)]

This is how you can do exactly what you asked:

index=tibco sourcetype=troubtibco host=sc58ltibp02 OR host=sc58ltibp03 source="/tibco/prod/bw/6.2/domains/WebAPI/appnodes/PrefComm-API-Space/*/log/bwappnode*.log"  MessageType != "NULL" | eval half=1/2 | timechart span=1d sum(half) by MessageType limit=0

kmccowen
Path Finder

This works great! What's the best way to get rid of the decimal places? Eval round?

0 Karma

woodcock
Esteemed Legend

Yes, that's the way to do it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...