I have a set of fixed fields that define a maximum threshold with the naming convention of "resources_available_[[convention]]"
and I have a variable set of fields which define a process consumption that will reference the naming convention like "resources_listed_[[convention]]"
The convention portion of the field names matches, but while one is fixed, the other will be based on whatever work is going on at the time. I'm trying to figure out how to calculate an evaluated percentage in time per convention (resources_listed_[[convention]])*(resources_available_[[convention]])/100 and the SPL to do this is just not coming to me...
Scenario example is I can get 30 events in, each with different values:
_time=now
resource_listed_a=23
resource_listed_a=102
resource_listed_cde=1200
resources_available_a=9201
resources_available_b=50
resources_available_cde=1
I want based on the event indexed: eval percent_consumed_[[convention]]=resource_listed_[[convention]]*resources_available_[[convention]]/100
Is this even possible?
You'd probably use foreach command here. Try like this
your current search which includes fields resource_listed_* andn resource_available_*
| foreach resource_listed_* [eval "percent_consumed_<<MATCHSTR>>"='resource_listed_<<MATCHSTR>>'*'resources_available_<<MATCHSTR>>'/100]
The <<MATCHSTR>>
and single quotes are to be used exactly as specified above (literal string).