SplunkCommands.md

Splunk Commands

Timechart

Count two fields and show ratio

index="abc" 
mycontroller MethodName=name1 OR MethodName=name2 
| timechart count(eval(MethodName="name1")) as method1count count(eval(MethodName="name2")) as method2count span=1h 
| eval ratio=((method1count/method2count)*10000)

Count the concat of two fields

index="abc" 
mycontroller#methodname 
| eval finalField=(field1.":".field2)
| timechart count by finalField