Splunk Search

operations on field values within multiple rows of the same source

trailhead26
New Member

I have one source and I need to use the field values from multiple rows to come up with an average. I have the data already indexed by _time. The data is like this.

1:00:00 field1=value1 field2=value2
1:00:00 field1=value3 field2=value4
1:00:00 field1=value5 field2=value6

this repeats every 30 seconds. I need to calculate as follows for every 30 second span

(value2 + value4)/value6

I have tried using append, but I can't figure out how to use the renamed values of "field2" to perform the operation I need to do and then visualize the data.

Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Okay, based on the assumptions in the comments you can do this:

index=foo sourcetype=bar | eval value2 = case(field1=value1, field2) | eval value4 = case(field1=value3, field2) | eval value6 = case(field1=value5, field2) | stats values(value*) as value* by _time | eval result = (value2 + value4) / value6 | timechart span=30s avg(result)

trailhead26
New Member

never mind, typo. I got it now. Thanks for your help.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can leave off the final timechart and see if the intermediate values are calculated correctly.

0 Karma

trailhead26
New Member

Thanks!
I don't think anything is being calculated in result. Is there a way to test that part?
My result always comes up blank

0 Karma

trailhead26
New Member

that is correct

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I see. Is it certain that these three events have the exact same timestamp and there is only one set of three for each timestamp?

0 Karma

trailhead26
New Member

by the values of field1

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

How do you identify the three different rows and their meaning?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...