topic Re: How to create fields dynamically in Splunk Search

How to create fields dynamically

wolfgangs — Mon, 20 Dec 2021 14:22:13 GMT

Hi,
I have events which contain 3 Fields: "StartDate", "Value_per_month" and "Nr_of_Month". They basically disclose some monthly financial flow which beginns at "StartDate" and ends after "Nr_of_Month".
The goal is to show a sum of "Value_per_month" for each month over all events.

In most cases the dates are in the future, so it will be a bit tricky to get this to work. However, at least a table view would be great and use some basic vizualisation on top. I thought I could create fields for each month, for example "value_yyyy-mm" and assign the value to each and then sum up the values in each field accross all events.
However I have not found a way to do this dynamically in a loop for X times, based on variable "Nr_of_Month".
I have checked combinations of eval, makeresults, foreach, gentimes, etc.

Any basic idea how to approach this would be welcome.
Many thanks in advance

Re: How to create fields dynamically

ITWhisperer — Mon, 20 Dec 2021 17:39:11 GMT

Can you give some sample events showing the issues you are dealing with?

Re: How to create fields dynamically

wolfgangs — Mon, 20 Dec 2021 19:44:49 GMT

of course an example might tell more than a page of explanation, sorry for not adding initially 😉
imagine several contracts with monthly payment, one contract per event. First one runs for 6 month, second for 4 month

	StartDate	Value of Month	Nr_of month
event 1	5th Dec 2021	3.5	6
event 2	8th Jan 2022	1.5	4

my thoughts to add fields:

	2021-12	2022-01	2022-02	2022-03	2022-04	2022-05
event 1	3.5	3.5	3.5	3.5	3.5	3.5
event 2	not existing	1.5	1.5	1.5	1.5	not existing

expected result:
I would like to see the payment to expect each month

Month	sum of Value
2021-12	3.5
2022-01	5
2022-02	5
2022-03	5
2022-04	5
2022-05	3.5