Splunk Search

How to combine wildcard results into one field?

splunklearner9
Engager
index=perfmonitor sourcetype=dc_perfmonitor source="f:*"  
| fields + host, "*Processor Time"   
| stats avg("*Processor Time") by host 

The output of this query results in a long list of hosts with a staggered table of the average of each machine's average total processor time. I wanted to combine all of these results into a single column.

Basically, I wanted to ask how do I create a new field using this wildcard search (it has a space in its name), as something more general, like "ProcessorTime" vs. "Machine1 Processor Time", "Machine2 Processor Time", "Machine3 Processor Time", etc.?

0 Karma
1 Solution

micahkemp
Champion

You can do this with foreach, but you definitely want to strongly consider if it's the best solution.

Here's a run anywhere example of this in action:

| makeresults | eval field1="10", field2="20"
| foreach field* [eval fields=mvappend(fields, '<<FIELD>>')]
| stats avg(fields)

And your search may look like:

 index=perfmonitor sourcetype=dc_perfmonitor source="f:*"  
 | fields + host, "*Processor Time" 
 | foreach "*Processor Time" [eval all_processor_times=mvappend(all_processor_times, '<<FIELD>>')]
 | stats avg(all_processor_times) by host

You may want to include some more details about your source data to help determine if there's a more appropriate way to accomplish what you're looking for.

View solution in original post

HiroshiSatoh
Champion

Is this bad?

 | stats avg("*Processor Time")  as "*Processor Time" by host 
0 Karma

micahkemp
Champion

You can do this with foreach, but you definitely want to strongly consider if it's the best solution.

Here's a run anywhere example of this in action:

| makeresults | eval field1="10", field2="20"
| foreach field* [eval fields=mvappend(fields, '<<FIELD>>')]
| stats avg(fields)

And your search may look like:

 index=perfmonitor sourcetype=dc_perfmonitor source="f:*"  
 | fields + host, "*Processor Time" 
 | foreach "*Processor Time" [eval all_processor_times=mvappend(all_processor_times, '<<FIELD>>')]
 | stats avg(all_processor_times) by host

You may want to include some more details about your source data to help determine if there's a more appropriate way to accomplish what you're looking for.

splunklearner9
Engager

This worked perfectly. Thanks! Never thought to do it like that.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...