Find percentage between two fields whose name will fall into a naming convention

mjones414 — Tue, 29 Sep 2020 18:33:42 GMT

I have a set of fixed fields that define a maximum threshold with the naming convention of "resources_available_[[convention]]"

and I have a variable set of fields which define a process consumption that will reference the naming convention like "resources_listed_[[convention]]"

The convention portion of the field names matches, but while one is fixed, the other will be based on whatever work is going on at the time. I'm trying to figure out how to calculate an evaluated percentage in time per convention (resources_listed_[[convention]])*(resources_available_[[convention]])/100 and the SPL to do this is just not coming to me...

Scenario example is I can get 30 events in, each with different values:
_time=now

resource_listed_a=23

resource_listed_b=9839

resource_listed_a=102

resource_listed_b=1

resource_listed_cde=1200

While I have a static condition of

resources_available_a=9201
resources_available_b=50
resources_available_cde=1

I want based on the event indexed: eval percent_consumed_[[convention]]=resource_listed_[[convention]]*resources_available_[[convention]]/100

Is this even possible?

Re: Find percentage between two fields whose name will fall into a naming convention

somesoni2 — Fri, 16 Mar 2018 20:17:54 GMT

You'd probably use foreach command here. Try like this

your current search which includes fields resource_listed_* andn resource_available_*
| foreach resource_listed_* [eval "percent_consumed_<<MATCHSTR>>"='resource_listed_<<MATCHSTR>>'*'resources_available_<<MATCHSTR>>'/100]

The <<MATCHSTR>> and single quotes are to be used exactly as specified above (literal string).

topic Re: Find percentage between two fields whose name will fall into a naming convention in Splunk Search

Find percentage between two fields whose name will fall into a naming convention

resource_listed_b=9839

resource_listed_b=1

While I have a static condition of

Re: Find percentage between two fields whose name will fall into a naming convention