Splunk Search

Table Creation: Evaluating the sum of fields and displaying them grouped by another field

splunk_question
Explorer

I have a bit of a data that looks like

base search term
| eval varA = fieldA/3
| eval varB = fieldB/36
| eval varC = varA * varB
| stats sum(varC) by NAME.

Where NAME is the value of another field - i.e., we have a bunch of data [vars A, B, and C] from one source, NAME. This code displays data in the format that I want: a statistics page with the sums of varC by NAME.

However, I am trying to generate a table of the format

NAME | varA | varB | varC | Performance

Where Performance checks to see if varC is >= a given number.

What is the Splunky way to do this? I'm trying not to get into bad habits.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this

base search term
 | eval varA = fieldA/3
 | eval varB = fieldB/36
 | eval varC = varA * varB
 | table Name varA varB varC 
 | eval Performance=if(varC>=SomeNumberHere,"Message1Here","Message2Here")

Now if you could explain what values should varA varB and varC should contain if aggregation needs to be done, we can include a stats command instead of table command. E.g. like you want to do max of varA and varB and sum of varC, just replace | table Name varA varB varC in above query with | stats max(varA) as varA max(varB) as varB sum(varC) as varC by Name.

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

base search term
 | eval varA = fieldA/3
 | eval varB = fieldB/36
 | eval varC = varA * varB
 | table Name varA varB varC 
 | eval Performance=if(varC>=SomeNumberHere,"Message1Here","Message2Here")

Now if you could explain what values should varA varB and varC should contain if aggregation needs to be done, we can include a stats command instead of table command. E.g. like you want to do max of varA and varB and sum of varC, just replace | table Name varA varB varC in above query with | stats max(varA) as varA max(varB) as varB sum(varC) as varC by Name.

0 Karma

kmaron
Motivator
 base search term
 | eval varA = fieldA/3
 | eval varB = fieldB/36
 | eval varC = varA * varB
 | eval Performance = if(varC >= X, Good, Bad)
 | stats sum(varC) by NAME, Performance

Depending on what you want for the value of Performance you can just add in a quick eval with an IF or a Case to set the field then add the field to your stats.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...