https://community.splunk.com/t5/Splunk-Search/Wildcards-in-eval-function-to-eval-unknown-fields/m-p/49165#M11770 <P>I've no spaces, the table above is an example, thats the results I get from splunk :</P> <P>index=summary_kihub source="summary_cus5_vdv_dfi_msg_business" earliest=-1h@h S_plattform=i_kihub | timechart span=1m c(S_FahrtID.FahrtBezeichner) by S_partner | rename * as *_avg, _time as _time | appendcols [search index=summary_kihub source="summary_cus5_vdv_dfi_msg_business" earliest=-2h@h S_plattform=i_kihub | timechart span=1m c(S_FahrtID.FahrtBezeichner) by S_partner] </P> <P>So I think we are not speeking about the same thing , are we ?</P> Mon, 28 Sep 2020 14:40:13 GMT sbsbb 2020-09-28T14:40:13Z https://community.splunk.com/t5/Splunk-Search/Wildcards-in-eval-function-to-eval-unknown-fields/m-p/49163#M11768 <P>I'm making a timechart, returning a unknown number of columns.<BR /> So I don't know how there named. I make appendcol, to add avg information, so I have :</P> <PRE><CODE> field1 field1_avg field2 field2_avg ... fieldN fieldN_avg </CODE></PRE> <P>08:00 2 3 2 2 4 5 </P> <P>I would like to eval a fieldx_delta=field*-field*_avg</P> <P>How could I achieved this ?</P> Mon, 28 Sep 2020 14:40:10 GMT https://community.splunk.com/t5/Splunk-Search/Wildcards-in-eval-function-to-eval-unknown-fields/m-p/49163#M11768 sbsbb 2020-09-28T14:40:10Z https://community.splunk.com/t5/Splunk-Search/Wildcards-in-eval-function-to-eval-unknown-fields/m-p/49164#M11769 <P>split it by consecutive spaces, get the total number then sum all of them divided by the total number. Note: Don't count the last field just count the spaces and add two to the total number. this will assume that time in the field1 is as of other fields so 1 in 3.</P> <P>If your first fields contains other then time then considered to be the sum. In that case you will have 2 sum one for field1 and one for all other fields the equation will be </P> <P>parity(sum+sum/2*(Total Number of Spaces + 2) +- 1) this will include 0 instead of all and the equation will not be thrown by null but by +1 or -1. This is not very fundamental it's just an equation where null could be the solution of your problem, don't be very optimistic if the solution is 1 or greater then it will be the sum. 1=sum , if your first field is 1 as other then you will not receive null as solution. In this case null doesn't exist my dear.</P> Wed, 28 Aug 2013 08:09:58 GMT https://community.splunk.com/t5/Splunk-Search/Wildcards-in-eval-function-to-eval-unknown-fields/m-p/49164#M11769 royimad 2013-08-28T08:09:58Z https://community.splunk.com/t5/Splunk-Search/Wildcards-in-eval-function-to-eval-unknown-fields/m-p/49165#M11770 <P>I've no spaces, the table above is an example, thats the results I get from splunk :</P> <P>index=summary_kihub source="summary_cus5_vdv_dfi_msg_business" earliest=-1h@h S_plattform=i_kihub | timechart span=1m c(S_FahrtID.FahrtBezeichner) by S_partner | rename * as *_avg, _time as _time | appendcols [search index=summary_kihub source="summary_cus5_vdv_dfi_msg_business" earliest=-2h@h S_plattform=i_kihub | timechart span=1m c(S_FahrtID.FahrtBezeichner) by S_partner] </P> <P>So I think we are not speeking about the same thing , are we ?</P> Mon, 28 Sep 2020 14:40:13 GMT https://community.splunk.com/t5/Splunk-Search/Wildcards-in-eval-function-to-eval-unknown-fields/m-p/49165#M11770 sbsbb 2020-09-28T14:40:13Z