Splunk Search

Timechart values using an eval field

dojiepreji
Path Finder

Hello all,

I have a search that goes like this:

index="_internal" (ticket_type="Incident") (classification="level-1" OR classification="level-2") (ticket_status="Closed" OR ticket_status="Resolved")
| stats dc(ticket_number) as "score" 
| eval r = 1 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-1" OR classification="level-2") (NOT ticket_status="Cancelled") (ticket_contract="Breached") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 1 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-1" OR classification="level-2") (ticket_status="Closed" OR ticket_status="Resolved") (NOT ticket_source="Alert") `comment("Priority Level 1 and 2 - Excluding Alerts)")` 
    | stats dc(ticket_number) as "score" 
    | eval r = 2 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-1" OR classification="level-2") (NOT ticket_status="Cancelled") (sla_response="Breached") (NOT ticket_source="Alert") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 2 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-1") (ticket_status="Closed" OR ticket_status="Resolved") 
    | stats dc(ticket_number) as "score" 
    | eval r = 3 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-1") (NOT ticket_status="Cancelled") (ticket_contract="Breached") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 3 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-2") (ticket_status="Closed" OR ticket_status="Resolved") 
    | eval r = 4 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-2") (NOT ticket_status="Cancelled") (ticket_contract="Breached") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 4 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-2") (ticket_status="Closed" OR ticket_status="Resolved") (NOT ticket_source="Alert") `comment("Priority 2 - Excluding Alerts")` 
    | stats dc(ticket_number) as "score" 
    | eval r = 5 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-2") (NOT ticket_status="Cancelled") (ticket_contract="Breached") (NOT ticket_source="Alert") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 5 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-3") (ticket_status="Closed" OR ticket_status="Resolved") 
    | stats dc(ticket_number) as "score" 
    | eval r = 6 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-3") (NOT ticket_status="Cancelled") (ticket_contract="Breached") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 6 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-3") (ticket_status="Closed" OR ticket_status="Resolved") 
    | stats dc(ticket_number) as "score" 
    | eval r = 7 ] 
| append 
    [ search index="_internal" (ticket_type="Incident") (classification="level-3") (NOT ticket_status="Cancelled") (ticket_contract="Breached") (NOT ticket_source="Alert") 
    | stats dc(ticket_number) as "missed" 
    | eval r = 7 ] 
| selfjoin r 
| eval met = score - missed 
| eval performance = round((met / score) * 100, 2) 

I am able to get the performance just fine.
However, I have to get the value of performance every month. I have tried:

| timechart span=1mon list(performance) as performance

...but nothing gets returned.

Can anybody please point me in the right direction?

Thank you.

0 Karma
1 Solution

HiroshiSatoh
Champion

Because _time does not exist.
Add "bin span = month _time" and "stats XXX by _time".

 | stats dc(ticket_number) as "score" 
 | eval r = 1 
↓
 | bin span=month _time
 | stats dc(ticket_number) as "score" by _time 
 | eval r = 1 

View solution in original post

0 Karma

HiroshiSatoh
Champion

Because _time does not exist.
Add "bin span = month _time" and "stats XXX by _time".

 | stats dc(ticket_number) as "score" 
 | eval r = 1 
↓
 | bin span=month _time
 | stats dc(ticket_number) as "score" by _time 
 | eval r = 1 
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...