topic Re: Include multiple fields of the same type in Splunk Search

How to include multiple fields of the same type?

trevor7 — Tue, 11 Apr 2023 16:31:15 GMT

I would like to add all instances of a field within the same variable, named SynchronousExecution. Is there a better way to include all fields of the same type?

| eval QPACAWTE_0001 = if(isNull(QPACAWTE_0001), 0, QPACAWTE_0001) | eval QPACAWTE_0002 = if(isNull(QPACAWTE_0002), 0, QPACAWTE_0002) | eval QPACAWTE_0003 = if(isNull(QPACAWTE_0003), 0, QPACAWTE_0003) | eval QPACAWTE_0004 = if(isNull(QPACAWTE_0004), 0, QPACAWTE_0004) | eval QPACAWTE_0005 = if(isNull(QPACAWTE_0005), 0, QPACAWTE_0005) | eval SynchronousExecution = QPACAWTE_0001 + QPACAWTE_0002 + QPACAWTE_0003 + QPACAWTE_0004 + QPACAWTE_0005

Thanks

Re: Include multiple fields of the same type

ITWhisperer — Tue, 11 Apr 2023 15:57:46 GMT

Assuming these are all numerics, you could do this

| eval SynchronousExecution = 0 | foreach QPACAWTE_* [| eval SynchronousExecution = SynchronousExecution + if(isnull(<<FIELD>>), 0, <<FIELD>>)]

Re: Include multiple fields of the same type

trevor7 — Tue, 11 Apr 2023 17:54:39 GMT

Thanks for your answer! This helps quite a bit.