Hi
I am looking for a search that iterates all my fieldname start with f* and get the statistics value of each f and get the large table.
sample data looks like this:
timestamp,f1,f2,f3,f4,f5,f6,f7,f8,f9
2014/04/01 00:00:00,0,2,3,1,2,5,6,9,3
2014/04/01 00:00:01,1,0,0,1,2,3,10,1,2
...
Now I have the following search, which does not run successfully.
index=sampledata
| head 1
| table f*
| transpose
| table column
| rename column as f_name
| map maxsearches=1000 search="index=sampledata | stats stdev($f_name$) as stdev | eval f_name=$f_name$"
I get this error message
Unable to run query 'index=sampledata | stats stdev(f1) as stdev | eval f_name=f1'.
I am trying to get the result that looks like this:
f_name, stdev
-------------
f1, 2
f2, 4
f3, 3
f4, 5
Anyone know how to use map command to do this?
Or anyother way to perform?
Hello,
You have missed search in the map search query.
....| map maxsearches=1000 search="search index=sampledata | stats stdev($f_name$) as stdev | eval f_name=$f_name$"
Thanks
How about this?
index=sampledata | stats stdev(f*)
Hello,
You have missed search in the map search query.
....| map maxsearches=1000 search="search index=sampledata | stats stdev($f_name$) as stdev | eval f_name=$f_name$"
Thanks
Thank you linu1988 for pointing out!
I forgot "search"... also f_name's double quote with escape. Now my search looks like this.
(now more stats inside the map command..)
....| map maxsearches=1000 search="search index=sampledata | stats stdev($f_name$) as stdev median($f_name$) as median | eval f_name=\"$f_name$\""