Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to get timechart to work in a search with multiple calculations

$
0
0
Hello, I am trying to make a timechart for my field "finalProfit" in the search below. I have tried doing timechart per_hour(finalProfit), eval commands in my timechart search, and a number of other options but I'm having no luck. If anyone can help me reorganize the search to work with the timechart command I would greatly appreciate it. Thanks! index=main sourcetype=marketapi | foreach name [ eval baseprice = pricePerOne] | eval savageDraught = case(name=="Wolf Blood", baseprice *4, name=="Blue Umbrella Mushroom", baseprice *4, name=="Bottle of River Water", baseprice *4, name=="Weeds", baseprice *1, name=="Monk's Branch", baseprice *16, name=="Moss Tree Sap", baseprice *16, name=="Powder of Darkness", baseprice *2, name=="Powder of Flame", baseprice *10, name=="Powder of Time", baseprice *6, name=="Red Tree Lump", baseprice *10, name=="Sky Blue Flower", baseprice *2, name=="Spirit's Leaf", baseprice *2, name=="Sunrise Herb", baseprice *1, name=="Thuja Sap", baseprice *12, name=="Violet Flower", baseprice *2, name=="Volcanic Umbrella Mushroom", baseprice *2) | eval savageDraught = savageDraught/2.5 | search savageDraught!='' | eval hammertime=_time | bucket span=1h hammertime | stats sum(savageDraught) AS craftedCost by hammertime | appendcols [search index=main sourcetype=marketapi name="Savage Draught" | eval Time=_time | eval purchaseCost = pricePerOne ] | eval profit=purchaseCost - craftedCost - 100000 | eval finalProfit=profit*.85

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>