topic Re: map command to do stats stdev($field_name$) ... in Splunk Search

map command to do stats stdev($field_name$) ...

melonman — Mon, 07 Apr 2014 09:59:34 GMT

I am looking for a search that iterates all my fieldname start with f* and get the statistics value of each f and get the large table.

sample data looks like this:

timestamp,f1,f2,f3,f4,f5,f6,f7,f8,f9
2014/04/01 00:00:00,0,2,3,1,2,5,6,9,3
2014/04/01 00:00:01,1,0,0,1,2,3,10,1,2
...

there are 100+ f* fields.

Now I have the following search, which does not run successfully.

index=sampledata
| head 1 
| table f* 
| transpose 
| table column 
| rename column as f_name 
| map maxsearches=1000 search="index=sampledata | stats stdev($f_name$) as stdev | eval f_name=$f_name$"

I get this error message

Unable to run query 'index=sampledata | stats stdev(f1) as stdev | eval f_name=f1'.

I am trying to get the result that looks like this:

f_name, stdev
-------------
f1, 2
f2, 4
f3, 3
f4, 5

Anyone know how to use map command to do this?
Or anyother way to perform?

Re: map command to do stats stdev($field_name$) ...

linu1988 — Mon, 07 Apr 2014 10:32:13 GMT

Hello,
You have missed search in the map search query.

....| map maxsearches=1000 search="search index=sampledata | stats stdev($f_name$) as stdev | eval f_name=$f_name$"

Thanks

Re: map command to do stats stdev($field_name$) ...

martin_mueller — Mon, 07 Apr 2014 12:53:02 GMT

How about this?

index=sampledata | stats stdev(f*)

Re: map command to do stats stdev($field_name$) ...

melonman — Mon, 28 Sep 2020 16:19:57 GMT

Thank you linu1988 for pointing out!

I forgot "search"... also f_name's double quote with escape. Now my search looks like this.
(now more stats inside the map command..)

....| map maxsearches=1000 search="search index=sampledata | stats stdev($f_name$) as stdev median($f_name$) as median | eval f_name=\"$f_name$\""