topic Generate a dynamic multi-value field based on a specific field in a search in Splunk Search

Generate a dynamic multi-value field based on a specific field in a search

elaoumam — Mon, 17 Jun 2019 19:06:25 GMT

Hi there,

I'm fairly new to Splunk searches.
I have a search in a log : index=tutti sourcetype=toto status!=4

Where I have 4 fields of interest namely : BeginTime (in epoch format), EndTime (in epoch format), LogTime (in epoch format) and Attempts.
I want a search that would generate a dynamic multi-value field ("|" separated), let's call it LogTimes, based on the following logic :

If Attempts =1 then LogTimes = LogTime
    elsif Attempts =2 then LogTimes = BeginTime|EndTime
    elsif Attempts =3 then LogTimes = BeginTime|BeginTime+(EndTime-BeginTime)/2|EndTime
    elsif Attempts = 4 then LogTimes = BeginTime|BeginTime+(EndTime-BeginTime)/3|BeginTime+2*(EndTime-BeginTime)/3|EndTime

Then it should count every timestamp occurrence (every single value in LogTimes) at the end.

elsif Attempts = n  then LogTimes = BeginTime|BeginTime+(EndTime-BeginTime)/(n-1)|BeginTime+2*(EndTime-BeginTime)/(n-1)|..............|BeginTime+(n-2)*(EndTime-BeginTime)/(n-1)|EndTime

Can someone help me, please?

Re: Generate a dynamic multi-value field based on a specific field in a search

somesoni2 — Mon, 17 Jun 2019 21:07:37 GMT

Can we have some sample data and corresponding output? Is the Attempts a field with literal numerical value of 1,2,3,4....?

Re: Generate a dynamic multi-value field based on a specific field in a search

elaoumam — Tue, 18 Jun 2019 14:10:57 GMT

Hi @somesoni2, yes it's a field with strict numerical values 1,2, 3, 4...
a data sample would look like :
Transaction_ID, status, Attempts, BeginTime, EndTime, LogTime
aH345kli, 0, 5, 1560861000, 1560864000, 1560863000

Re: Generate a dynamic multi-value field based on a specific field in a search

elaoumam — Wed, 30 Sep 2020 01:00:50 GMT

Basically if I have an event like the following :
Transaction_ID,status,Attempts,BeginTime,EndTime,LogTime
aH345kli,0,3,1560861000,1560864000,1560863000
I should end up with something like :
Transaction_ID,status,Attempts,BeginTime,EndTime,LogTime,LogTimes
aH345kli,0,3,1560861000,1560864000,1560863000,1560861000|1560862500|1560864000
If it's like :
Transaction_ID,status,Attempts,BeginTime,EndTime,LogTime
aH345kli,0,1,1560861000,1560864000,1560863000
It should be :
Transaction_ID,status,Attempts,BeginTime,EndTime,LogTime,LogTimes
aH345kli,0,1,1560861000,1560864000,1560863000,1560863000
and so on.
And then return the corresponding total count of each timestamp in LogTimes (on all event) in a span of 1 min.