The result of a splunk query is the following:
Result set 1:
method success failures Over_method1 Over_method2 Over_method3
method1 0 73 3 0 0
method2 196 0 0 2 0
I need to reduce this result set as follow:
method success failures Over
method1 0 73 3
method2 196 0 2
I tried using the search command foreach but no success.
Splunk search to get result set 1|
foreach Over_* [eval Over=Over+<<FIELD>>]|
table method success failures Over
OR
Splunk to get result set 1|
foreach Over_* [eval Over=Over+'<<FIELD>>']|
table method success failures Over
This could be done with the following query:
Splunk search to get result set 1|
=if(Over_method1>0,Over_method1,if(Over_method2>0,Over_method2,0))|
table method success failures Over
However, A simpler way is to use the foreach function. To make it work the mapping variable needs to be initialized as presented in below answer. If not the result set will not be reduced correctly. So the final query is:
Splunk to get result set 1|eval Over=0|
foreach Over_* [eval Over=Over+'<<FIELD>>']|
table method success failures Over
Thanks,
Lp
However, After reading the answer presented bellow I made a little change for the eval expression to work, <
Try this
Splunk search to get result set 1| eval Over=0 | foreach Over_* [eval Over=Over + <<FIELD>>]|table method success failures Over
Alternative (using untable)
Splunk search to get result set 1 | untable method key value | eval key=case(like(key,"Over%"),"Over",1=1,key) | chart sum(value) over method by key
Thanks. I made a little change for the eval expression to work, <
|Splunk search to get result set 1|eval Over=0 | foreach Over_* [eval Over=Over+'<