topic Re: Add value on a column without csv input file in Splunk Search

Add value on a column without csv input file

Lucie99 — Mon, 17 Aug 2020 11:04:57 GMT

Hi everyone,

I need to put in these fix values on the Interval_tolerance column. Has somebody an idea ?

Thanks

Re: Add value on a column without csv input file

FrankVl — Mon, 17 Aug 2020 11:36:51 GMT

Just do this in each of the sections of your search (replacing the ... by the respective value):

| eval Interval_tolerance = ...

Also, your search can be simplified a lot by doing both avg and stdev calculations in 1 go instead of the "appendcols"

| stats avg(Moy) as AV stdev(Moy) as SD by Debit

Re: Add value on a column without csv input file

Lucie99 — Mon, 17 Aug 2020 12:32:46 GMT

Thanks !! It works

My code is also shorter !

Have a nice week

Re: Add value on a column without csv input file

FrankVl — Mon, 17 Aug 2020 15:38:24 GMT

Looking at it once more, you can get rid of that whole "appends" approach, by simply removing the 'Debit=...' part from your search. Or replace it by Debit IN(a,b,c) if the data source contains other debit values which you want to ignore. Because the Debit field is the only thing that is different between the various appends bits, and you already do a 'by Debit' in your stats.

Then you can do the eval like this:

| eval Interval_tolerance = case(Debit=a,x,Debit=b,y,Debit=c,z)