Splunk Search

Timechart with multiple fields and calculating percentage

benobviate
Explorer

My query is something like

.. | eval color_and_shape = color + "/" + shape
| timechart count as total, count(eval(heavy="true")) as heavy by color_and_shape

which returns a table similar to

_time heavy:green/triangle heavy:green/circle total:green/triangle total:green/circle

11/20/12 1 2 5 6

How would I go about calculating the percentage of shapes that a heavy by color_and_shape?

I tried doing ...| eval pct=sc/total
but this does not work.

1 Solution

jonuwz
Influencer

The problem is that after you've run the results through timechart, you no longer know all the combinations of column headers you'll need to calculate the percentage.

A better way of approaching this would be to work out the percentages before running timechart like this :

... | eval color_and_shape = color + "/" + shape
    | bin _time span=1d 
    | stats count as total, count(eval(heavy="true")) as heavy by color_and_shape _time 
    | eval perc_heavy=100*heavy/total 

Then you can do the timechart

... | timechart span=1d first(total) as total first(heavy) as heavy first(perc_heavy) as perc_heavy by color_and_shape

View solution in original post

jonuwz
Influencer

The problem is that after you've run the results through timechart, you no longer know all the combinations of column headers you'll need to calculate the percentage.

A better way of approaching this would be to work out the percentages before running timechart like this :

... | eval color_and_shape = color + "/" + shape
    | bin _time span=1d 
    | stats count as total, count(eval(heavy="true")) as heavy by color_and_shape _time 
    | eval perc_heavy=100*heavy/total 

Then you can do the timechart

... | timechart span=1d first(total) as total first(heavy) as heavy first(perc_heavy) as perc_heavy by color_and_shape
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...