Splunk Search

How to summarize a lot of fields with mvappend

takeru
New Member

I am trying to find the standard deviation from the postfix log.
I assume the following search sentence.

index=postfix earliest=-50d
| timechart span=1d count by fromaddress
| eval readable_time=strftime(_time, "%Y-%m-%d ")
| fields - NULL OTHER _time _span _spandays
| transpose 50
| rename "row " as day
| eval mvfield=mvappend(day1,day2,day3,day4,day5............)
| stats avg(mvfield) as avg stdev(mvfield) as std by column

Is there a way to more easily define day 1 to day 50?
| eval mvfield=mvappend(day1,day2,day3,day4,day5............)

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

index=postfix earliest=-50d
| timechart span=1d count by fromaddress
| eval readable_time=strftime(_time, "%Y-%m-%d ")
| fields - NULL OTHER _time _span _spandays
| transpose 50
| rename "row " as day
| eval mvfield=null() | foreach day* [eval mvfield=mvappend(mvfield,'<<FIELD>>')]
| stats avg(mvfield) as avg stdev(mvfield) as std by column

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try

index=postfix earliest=-50d
| timechart span=1d count by fromaddress
| eval readable_time=strftime(_time, "%Y-%m-%d ")
| fields - NULL OTHER _time _span _spandays
| transpose 50
| rename "row " as day
| eval mvfield=null() | foreach day* [eval mvfield=mvappend(mvfield,'<<FIELD>>')]
| stats avg(mvfield) as avg stdev(mvfield) as std by column
0 Karma

somesoni2
Revered Legend

Also, try this

index=postfix earliest=-50d
 | timechart span=1d count by fromaddress
 | eval readable_time=strftime(_time, "%Y-%m-%d ")
 | fields - NULL OTHER _time _span _spandays
| untable readable_time column valuefield
| stats avg(valuefield) stdev(valuefield) by column
0 Karma

takeru
New Member

The answer I was hoping for
Thank you!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...