Splunk Search

Displaying calculated value in timechart

jimjohn
Path Finder

My search sting is like:

host=A|rename "ERC" TO EMPLOYERCODE|join EMPLOYERCODE [search host= B|rename EMPLOYER_CODE TO EMPLOYERCODE ]|timechart span=1d sum(Visits) AS Visit, count(USER_NAME) AS User by EMPLOYERCODE| eval avg=Visit/User|table _time,avg.

My purpose is to generate a timechart with avg in y axis.
I am unable to display the avg in timechart. I am getting blank in average when using the above.Can you help me.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The table call at the end is weird. Let's convert this to a simple, run-anywhere example:

index=_internal | timechart bins=20 sum(bytes) as Visit count(user) as User | eval avg = Visit/User | fields - Visit User

This works for me, fills the column avg and removes the other two columns.

0 Karma

jimjohn
Path Finder

foreach solved my problem.

0 Karma

jimjohn
Path Finder

Thanks ,Let me try for each.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Ah, I missed that. In that case you don't have fields called avg and User but rather (I guess) some_employer: avg and some_employer: User. If that's the case, foreach is your friend - exact syntax depends on what fieldnames you have after the timechart.

0 Karma

jimjohn
Path Finder

The solution woks fine if we doesn't use by EMPLOYERCODE.
I need the result of sum and visits grouped by EMPLOYERCODE.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...