Hello Splunk World,
Back at it today trying to chart out some power data off of generators.
I have 2 queries that need combined with different calculations.
Query 1. this query reports the way it should:
eval CurrentLoad=dcCurrentLoad/100, CurrentBattery=dcCurrentBattery/100, PowerBattery=dcPowerBattery/100 | timechart avg(CurrentLoad) as "Current Load", avg(CurrentBattery) as "Current Battery", avg(PowerBattery) as "Power Battery"
Query 2. same meaning, different language, however the calculations from the MFG stats that if we see a value "32768 or higher" this is a negative number so we calculate (value minus 65536 / 100
eval AlternatorCurrent=ppscAlternatorCurrent/100, CurrentBattery=ppscLoadBatteryCurrent/100, VoltageBattery=ppscLoadBatteryVoltage/100 | timechart avg(AlternatorCurrent) as "Alternator Current", avg(CurrentBattery) as "Battery Current", avg(VoltageBattery) as "Battery Voltage"
I did not add the Index or source type as that is already figured out to combine, the script in the query is where I am running into problems.
Thoughts or ideas?
I tried the coalesce that was provided a couple of days ago, thought it was working but was not certain.
... View more