topic Performing calculations on multi-valued fields in Splunk Search

Performing calculations on multi-valued fields

ztayluh — Tue, 29 Sep 2020 23:47:26 GMT

Hello, I am trying to perform calculations on multiple fields.

I am working with data in the format of Key='value1,value2,value3,value4' which can contain anywhere from 1 to 4 values.

Input:
height='32,12,14,13' or width='32'
as well as variance='3.24e-2,4.23e+3,1.12e-4,1.01e-3'

Expected Output:
height=17.75
width=32
variance=1.0575e+3

Actual Output:
height=032,12,14,13, width=32
variance=03.24e-2,4.23e+3,1.12e-4,1.01e-3

Thank you in advance for any help provided!

Re: Performing calculations on multi-valued fields

adonio — Fri, 22 Mar 2019 18:31:48 GMT

can you share sample events and desired results?

Re: Performing calculations on multi-valued fields

ztayluh — Fri, 22 Mar 2019 19:01:23 GMT

Hi Adonio, here is an example event.

21-Mar-19 05:10:46 
total_Height_mm='66,41,29,28'

Each event has a different multi-value pair.
There are ~150+ events per source

Thank you!

Re: Performing calculations on multi-valued fields

adonio — Sat, 23 Mar 2019 21:30:19 GMT

I am still puzzled as to what is the desired output ...
can you share at least 10 events and the desired output from search?

Re: Performing calculations on multi-valued fields

ztayluh — Tue, 29 Sep 2020 23:52:06 GMT

I apologize, hopefully this will be clearer

If I had an event like this:
21-Mar-19 05:10:46 total_Height_mm='66,41,29,28'

I would expect to get:
avg_total_Height_mm=(66 + 41 + 29 + 28)/4 = 41

Here are some additional events and their desired output:

21-Mar-19 05:10:46 total_Pressure_psi='16.16,16.16,16.16,16.16'

Output:
avg_total_Pressure_psi = 16.16

21-Mar-19 05:10:46 total_Pressure_kpa='3.2405e+2,3.8095e+2,3.4152e+2,3.9155e+2'

Output:
avg_total_Pressure_kpa=3.595175e+2

Thank you.

Re: Performing calculations on multi-valued fields

adonio — Tue, 26 Mar 2019 13:23:27 GMT

hope i understood your question, try this out.
also, plenty will depend on how the data is indexed and the fields you extract

| makeresults count=1
| eval data = "21-Mar-19 05:10:46 total_Height_mm='66,41,29,28';;;21-Mar-19 05:10:46 total_Pressure_psi='16.16,16.16,16.16,16.16';;;21-Mar-19 05:10:46 total_Pressure_kpa='3.2405e+2,3.8095e+2,3.4152e+2,3.9155e+2'"
| makemv delim=";;;" data 
| mvexpand data
| rex field=data "(?<time>\S+\s\S+)\s(?<fields>[^\=]+)\=\'(?<values>[^\']+)"
| makemv delim="," values
| mvexpand values
| stats avg(values) as avg_value by fields