I have an interesting situation where I want to be able to display a little summary table, showing a few statistics about a small number of fields, as calculated from a restricted set of events.
Basically I want it to look like the below:
field | avg | min | max |
---|---|---|---|
avg_age | 0.000000 | 0.000000 | 0.000000 |
eps | 0.935385 | 0.064514 | 2.836625 |
ev | 34.869565 | 2 | 86 |
kb | 6.600976 | 0.244141 | 16.830078 |
The closest I've gotten is this search:
foo | fields avg_age eps ev kb | fields - _* | stats values(*) as * | transpose | rename column as field "row 1" as value | eval value=split(value, " ") | stats avg(value) as avg min(value) as min max(value) as max by field
which looks like it works. However I think the use of multivalue fields here is going to lead to truncation and thus the statistics aren't going to be trustworthy.
Can anyone help? I have this feeling that there's something simple I'm missing? Like if there was a 'summary' command:
summary stats="min,max,avg" fields="avg_age eps ev kb"
Not that much easier, but here you go:
... | fields field1 field1 | stats min max avg | transpose | rex field=column "(?<stat>[^\(]+)\((?<field>[^\)]+)" | rename "row 1" as value | xyseries field stat value
Also, it's fairly easy to create a macro:
[summary_stats(2)]
args = fields,stats
definition = fields $fields$ | stats $stats$ | transpose | rex field=column "(?<stat>[^\(]+)\((?<field>[^\)]+)" | rename "row 1" as value | xyseries field stat value
iseval = 0
which makes the search easier to read:
... | `summary_stats(field1 field2 field3, min max avg)`
Not that much easier, but here you go:
... | fields field1 field1 | stats min max avg | transpose | rex field=column "(?<stat>[^\(]+)\((?<field>[^\)]+)" | rename "row 1" as value | xyseries field stat value
Also, it's fairly easy to create a macro:
[summary_stats(2)]
args = fields,stats
definition = fields $fields$ | stats $stats$ | transpose | rex field=column "(?<stat>[^\(]+)\((?<field>[^\)]+)" | rename "row 1" as value | xyseries field stat value
iseval = 0
which makes the search easier to read:
... | `summary_stats(field1 field2 field3, min max avg)`
Awesome answer. Since it doesn't use values() it wont get truncated. Thanks!