topic Re: How to split values present in a cell in different rows? in Getting Data In

How to split values present in a cell in different rows?

rajeswarir — Tue, 31 Jul 2018 09:33:03 GMT

In this attached multiple values are grouped in table. I want to split all the values separately so that i can calculate average for each field

Re: How to split values present in a cell in different rows?

493669 — Tue, 31 Jul 2018 09:47:31 GMT

Have look at this answer by @mrobichaud_splunk ,
https://answers.splunk.com/answers/25653/mvexpand-multiple-multi-value-fields.html

Re: How to split values present in a cell in different rows?

niketn — Tue, 31 Jul 2018 10:18:15 GMT

@rajeswarir what is your existing query which gives the above table. If you are interested in Average and not multi valued fields, you can do the same upfront using appropriate statistical function from transforming command. Rather than circumventing through multi-valued field.

Re: How to split values present in a cell in different rows?

rajeswarir — Tue, 29 Sep 2020 20:41:35 GMT

Hi niketnilay,

my query is:
source="K_range.log" OR source="AD_range.log" OR source="R_range.zip:" Cycle={C3.100.5}
|transaction CommonFieldbetweenalllogs
|table S.No Cycle R_Time K_Time A_Time D_Time|eval S.No=1 | accum S.No

can u please explain how can i compute average without splitting the values using transforming command.

I need to calculate 2 things here:
1. Average for all the fields
2. one more field named "RA_Time" which is the addition of R_Time+A_Time