index=perfmonitor sourcetype=dc_perfmonitor source="f:*"
| fields + host, "*Processor Time"
| stats avg("*Processor Time") by host
The output of this query results in a long list of hosts with a staggered table of the average of each machine's average total processor time. I wanted to combine all of these results into a single column.
Basically, I wanted to ask how do I create a new field using this wildcard search (it has a space in its name), as something more general, like "ProcessorTime" vs. "Machine1 Processor Time", "Machine2 Processor Time", "Machine3 Processor Time", etc.?
You can do this with foreach, but you definitely want to strongly consider if it's the best solution.
Here's a run anywhere example of this in action:
| makeresults | eval field1="10", field2="20"
| foreach field* [eval fields=mvappend(fields, '<<FIELD>>')]
| stats avg(fields)
And your search may look like:
index=perfmonitor sourcetype=dc_perfmonitor source="f:*"
| fields + host, "*Processor Time"
| foreach "*Processor Time" [eval all_processor_times=mvappend(all_processor_times, '<<FIELD>>')]
| stats avg(all_processor_times) by host
You may want to include some more details about your source data to help determine if there's a more appropriate way to accomplish what you're looking for.
Is this bad?
| stats avg("*Processor Time") as "*Processor Time" by host
You can do this with foreach, but you definitely want to strongly consider if it's the best solution.
Here's a run anywhere example of this in action:
| makeresults | eval field1="10", field2="20"
| foreach field* [eval fields=mvappend(fields, '<<FIELD>>')]
| stats avg(fields)
And your search may look like:
index=perfmonitor sourcetype=dc_perfmonitor source="f:*"
| fields + host, "*Processor Time"
| foreach "*Processor Time" [eval all_processor_times=mvappend(all_processor_times, '<<FIELD>>')]
| stats avg(all_processor_times) by host
You may want to include some more details about your source data to help determine if there's a more appropriate way to accomplish what you're looking for.
This worked perfectly. Thanks! Never thought to do it like that.