Let us say I have 5 unique fields in my logs (var1 thru var5), I would like to first find the mean of the individual fields ( avg(var*) ) and store them in a new field, say "avg_var". Then, I would like to get the difference of max(avg_var) and min(avg_var).
The following search provides me a table of the 1st part, but then I don't know how to get the min and max of the 5 unique fields.
sourcetype="src" var* | stats avg(var*) BY unitNo
result:
unitNo, avg(var1), avg(var2), avg(var3), avg(var4), avg(var5)
1, 12, 32, 63, 13, 45
..
..
Any help would be very much appreciated.
You can do this:
sourcetype="src" var* | stats avg(var*) as avg_var* BY unitNo | stats range(avg_var*) as range_var*
range()
effectively computes max()-min()
in one step. You should get one row with five columns as a result.
Edit: Search to compute range per row rather than per column:
sourcetype="src" var*
| stats avg(var*) as avg_var* BY unitNo
| foreach avg_var* [eval max = max(max, <<FIELD>>) | eval min = min(min, <<FIELD>>)]
| eval range = max - min
Great. I've added the updated search to the answer so you can mark it as solved.
It worked! Thank you so much.
I see... something like this?
sourcetype="src" var*
| stats avg(var*) as avg_var* BY unitNo
| foreach avg_var* [eval max = max(max, <<FIELD>>) | eval min = min(min, <<FIELD>>)]
| eval range = max - min
The foreach
will compute the max
and min
values, and the final eval
will return range=51
for the example row. Requires Splunk 6 to work.
Thanks for the response. Your solution computes the range for each column and provides it in a row. However, I am looking to get the range for 5 variables for which I have the average. In my above example, the answer I was looking for is 63 - 12 = 51. Any suggestions on how to convert the individual fields as one field so that I can compute the range?