I have 2 questions:
Is it possible to aggregate some values of a field into one value??
For example I have in the field "products" the values Mercedes,Ferrari,Porsche, apple,banana.... and I want to aggregate them in 2 values "cars" and "fruit"?!
And if I have a list with values from 2011 and 2012 is it possible to get for example the mean of 2011 and the mean of 2012 in ONE result table????
I'm new with Splunk so maybe my questions are too easy:-)
You can use the eval command to selectively create a field depending on its value:
... | eval car=if(match(product,"(?i)^(mercedes|ferrari|porsche)$"),null()) | eval fruit=if(match(product,"(?i)^(apple|banana)$"),null()) | stats values(car) values(fruit)
You can use the split-by clause in the stats command, to create an aggregated value for each year:
... | eval year=strftime(_time,"%Y") | stats mean(somefield) by year
Edit, to answer the question in the comment: yes, you can do something like this
... | eval type=case(match(product,"(?i)^(mercedes|ferrari|porsche)$"),"car",match(product,"(?i)^(apple|banana)$"),"fruit") | eval year=strftime(_time,"%Y") | chart mean(somefield) over type by year
You can use the eval command to selectively create a field depending on its value:
... | eval car=if(match(product,"(?i)^(mercedes|ferrari|porsche)$"),null()) | eval fruit=if(match(product,"(?i)^(apple|banana)$"),null()) | stats values(car) values(fruit)
You can use the split-by clause in the stats command, to create an aggregated value for each year:
... | eval year=strftime(_time,"%Y") | stats mean(somefield) by year
Edit, to answer the question in the comment: yes, you can do something like this
... | eval type=case(match(product,"(?i)^(mercedes|ferrari|porsche)$"),"car",match(product,"(?i)^(apple|banana)$"),"fruit") | eval year=strftime(_time,"%Y") | chart mean(somefield) over type by year
yes, updated the anwer...
thanks for your answer, but ist it also possible to get for example a table like this:
2011 2012
cars value1 value2
fruits value3 value4
... ... ...
???