Splunk Search

How do i reference columns that have been displayed as a result of previous chart command

monyathomas
New Member

I have done a chart command --> chart count over "Survey Month" by "Survey Type" and the result displays the two survey types "a" and "b" as columns along with Survey month . Now how do i further reference column a and b to perform other calculations?

Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

After chart command, you'd see value of "Survey Type" field appearing as separate fields (in your example "a" and "b"). So you'd reference them like any other field, but would use "a" or "b" instead of "Survey Type". If they contain spaces, hyphen or other special characters, use them within single quotes in eval and where expressions, and within double quotes in other places.

e.g. (just an example of syntax)

base search | chart count over "Survey Month" by "Survey Type"  | eval "a"='a'*20 | where 'b'<'a'  | stats sum("b") as "B" by "a"

View solution in original post

0 Karma

woodcock
Esteemed Legend

You should just be able to use a and b but if you need it to be oriented differently, then you can switch from using chart to using stats or you could use the untable command to do the same thing.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

After chart command, you'd see value of "Survey Type" field appearing as separate fields (in your example "a" and "b"). So you'd reference them like any other field, but would use "a" or "b" instead of "Survey Type". If they contain spaces, hyphen or other special characters, use them within single quotes in eval and where expressions, and within double quotes in other places.

e.g. (just an example of syntax)

base search | chart count over "Survey Month" by "Survey Type"  | eval "a"='a'*20 | where 'b'<'a'  | stats sum("b") as "B" by "a"
0 Karma

monyathomas
New Member

Thanks a ton! This helps!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@monyathomas If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jnudell_2
Builder

Can you provide some sample data and a more clear idea of what calculations you are looking to do after the initial chart command?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...