Dashboards & Visualizations

adding two columns and plot timechart

mrigendra
New Member

Hi, I want to plot sum of two columns and plot it as timechart. Here is what I am doing,

source="2weeks.csv" | timechart eval(sum(FemaleGTotal) + sum(MaleGTotal))

This doesn't seems to work, where as both the following queries run fine.

source="2weeks.csv" | timechart sum(FemaleGTotal)

source="2weeks.csv" | timechart sum(MaleGTotal)
Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Use:

... | timechart sum(F) as sumf, sum(M) as summ | eval t=sumf+summ

Unless you're looking for:

... | timechart sum( eval(F + M) ) as t

Which differs in how null values are handled.

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Use:

... | timechart sum(F) as sumf, sum(M) as summ | eval t=sumf+summ

Unless you're looking for:

... | timechart sum( eval(F + M) ) as t

Which differs in how null values are handled.

0 Karma

mrigendra
New Member

@gkanapathy: thanks, both queries are helpful to me. But what you mean, when you say that they differ in how null values are handled?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...