Splunk Search

How to construct columns with the same data, and then use these pseudo columns to calculate

flzhang132
Explorer

I want to get data ,as following
alt text

How to construct columns with the same data, and then use these pseudo columns to calculate in splunk ?

Tags (2)
0 Karma
1 Solution

adonio
Ultra Champion

hello there,

here is an example with search and eval

... search that captures fields project and pfee ...
| eventstats sum(pfee) as total 
| table project pfee 
| eventstats sum(pfee) as total
| eval other = if(project="other",pfee,null())
| eventstats max(other) as other
| eval total_minus_other = total - other
| eval ratio = round(pfee/total_minus_other, 2)
| eval pfee_plus_pfee_times_ratio = pfee + pfee*ratio

here is a sample to run anywhere:

| makeresults count=1 
| eval data = "p1,1;p2,2;p3,3;p4,10;p5,20;other,30"
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<project>\S+)\,(?<pfee>\d{1,5})"
| table project pfee
| eventstats sum(pfee) as total
| eval other = if(project="other",pfee,null())
| eventstats max(other) as other
| eval total_minus_other = total - other
| eval ratio = round(pfee/total_minus_other, 2)
| eval pfee_plus_pfee_times_ratio = pfee + pfee*ratio

hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

hello there,

here is an example with search and eval

... search that captures fields project and pfee ...
| eventstats sum(pfee) as total 
| table project pfee 
| eventstats sum(pfee) as total
| eval other = if(project="other",pfee,null())
| eventstats max(other) as other
| eval total_minus_other = total - other
| eval ratio = round(pfee/total_minus_other, 2)
| eval pfee_plus_pfee_times_ratio = pfee + pfee*ratio

here is a sample to run anywhere:

| makeresults count=1 
| eval data = "p1,1;p2,2;p3,3;p4,10;p5,20;other,30"
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<project>\S+)\,(?<pfee>\d{1,5})"
| table project pfee
| eventstats sum(pfee) as total
| eval other = if(project="other",pfee,null())
| eventstats max(other) as other
| eval total_minus_other = total - other
| eval ratio = round(pfee/total_minus_other, 2)
| eval pfee_plus_pfee_times_ratio = pfee + pfee*ratio

hope it helps

0 Karma

flzhang132
Explorer

you are great , thank you very much

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Can you clarify which fields exists already, and which fields you are trying to construct?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...