How to add average column to timewrap table for multiple fields?

michaelsplunk1 — Thu, 17 Mar 2022 21:49:35 GMT

Hi there!

I want to add columns to this table that I copied from the docs about timewrap. I want to add columns that have the averages for each field (accessories, sports, strategy, etc.) across the timewrapped columns. Basically, a column for the average of ACCESSORIES_S1, ACCESSORIES_S0, etc., and then a column for the average of SPORTS_S1, SPORTS_S0, etc., and a column for the average of STRATEGY_S1, STRATEGY_S0, etc.

michaelsplunk1_0-1647551329507.png

Additionally, I eventually want to use these averages as a trigger for an alert when the counts on these (i.e., accessories, sports, strategy, etc.) surpass the average. Long story short, I have an arbitrary number of fields, with a count on those fields, and I want to alert when the count on those fields exceeds the average, without having to set up multiple alerts for each field because I don't know what the fields are going to be ahead of time and the field names can change.

@mattymo your multipart article on timewrap and Cyclical Statistical Forecasts and Anomalies has helped me so much, can you please help me on this application of timewrap?

Thank you!

Re: How to add average column to timewrap table for multiple fields?

ITWhisperer — Fri, 18 Mar 2022 09:31:39 GMT

| foreach *_s* [| eval "<<MATCHSEG1>>_total"=if(isnull('<<FIELD>>'),'<<MATCHSEG1>>_total',if(isnull('<<MATCHSEG1>>_total'),'<<FIELD>>','<<MATCHSEG1>>_total'+'<<FIELD>>')) | eval "<<MATCHSEG1>>_count"=if(isnull('<<FIELD>>'),'<<MATCHSEG1>>_count',if(isnull('<<MATCHSEG1>>_count'),1,'<<MATCHSEG1>>_count'+1))] | foreach *_total [| eval "<<MATCHSEG1>>_average"='<<MATCHSEG1>>_total'/'<<MATCHSEG1>>_count']

topic Re: How to add average column to timewrap table for multiple fields? in Splunk Search

How to add average column to timewrap table for multiple fields?

Re: How to add average column to timewrap table for multiple fields?