Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Renaming column names(field value) in a search result

$
0
0
We have a test index which captures all the response times of different transactions by version I wrote a search to display different response times by different transactions and version *index=testing test_type=CI test_function="ok.pct90" | chart avg(transaction_RT_val) AS "90%_RT" by transaction,version* I want to write to show the difference in response time between every ve![alt text][1]rsion (Version numbers keep on changing every time) Maybe some thing like this but the problem with this one is the version number always change *index=testing test_type=CI test_function="ok.pct90" | chart avg(transaction_RT_val) AS "90%_RT" by transaction,version | rename "99864.0.0" as Test1,"99867.0.0" as Test2 ,"99868.0.0" as Test3 | eval Change1 = ((Test2-Test1)/Test2*100) | eval Change2 = ((Test3-Test2)/Test3*100) | fields transaction,Change1,Change2* Preferably I want to filter the results to show a maximum of last 5 versions [1]: /storage/temp/106196-change.png

Viewing all articles
Browse latest Browse all 47296

Trending Articles