I want to get data ,as following
How to construct columns with the same data, and then use these pseudo columns to calculate in splunk ?
hello there,
here is an example with search and eval
... search that captures fields project and pfee ...
| eventstats sum(pfee) as total
| table project pfee
| eventstats sum(pfee) as total
| eval other = if(project="other",pfee,null())
| eventstats max(other) as other
| eval total_minus_other = total - other
| eval ratio = round(pfee/total_minus_other, 2)
| eval pfee_plus_pfee_times_ratio = pfee + pfee*ratio
here is a sample to run anywhere:
| makeresults count=1
| eval data = "p1,1;p2,2;p3,3;p4,10;p5,20;other,30"
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<project>\S+)\,(?<pfee>\d{1,5})"
| table project pfee
| eventstats sum(pfee) as total
| eval other = if(project="other",pfee,null())
| eventstats max(other) as other
| eval total_minus_other = total - other
| eval ratio = round(pfee/total_minus_other, 2)
| eval pfee_plus_pfee_times_ratio = pfee + pfee*ratio
hope it helps
hello there,
here is an example with search and eval
... search that captures fields project and pfee ...
| eventstats sum(pfee) as total
| table project pfee
| eventstats sum(pfee) as total
| eval other = if(project="other",pfee,null())
| eventstats max(other) as other
| eval total_minus_other = total - other
| eval ratio = round(pfee/total_minus_other, 2)
| eval pfee_plus_pfee_times_ratio = pfee + pfee*ratio
here is a sample to run anywhere:
| makeresults count=1
| eval data = "p1,1;p2,2;p3,3;p4,10;p5,20;other,30"
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<project>\S+)\,(?<pfee>\d{1,5})"
| table project pfee
| eventstats sum(pfee) as total
| eval other = if(project="other",pfee,null())
| eventstats max(other) as other
| eval total_minus_other = total - other
| eval ratio = round(pfee/total_minus_other, 2)
| eval pfee_plus_pfee_times_ratio = pfee + pfee*ratio
hope it helps
you are great , thank you very much
Can you clarify which fields exists already, and which fields you are trying to construct?