topic Re: Calculate a value based on multiple events in Splunk Search

Calculate a value based on multiple events

larsxschneider — Sun, 28 Sep 2014 20:20:48 GMT

My events have the following structure:
id=[id] key=[key] value=[value]

For example:
id=1 key=mycounter value=4
id=1 key=mytime value=40
id=2 key=mycounter value=5
id=2 key=mytime value=70
id=3 key=mycounter value=8
id=3 key=mytime value=90

I would like to calculate mycounter/mytime for each id.

I created a table ((key=mycounter OR key=mytime) | dedup id, key | table id, key, value) and tried to apply mvcombine and makemv, but I was not able to get it working. Is this the right way to go or is there a better way in Splunk?

Re: Calculate a value based on multiple events

martin_mueller — Sun, 28 Sep 2014 20:23:41 GMT

Try this:

key=mycounter OR key=mytime | eval value_{key} = value | stats first(value_*) as * by id | eval result = mycounter / mytime

The first eval creates two fields, value_mycounter and value_mytime. The stats merges the two events into one for each id. The final eval does the actual maths.

Re: Calculate a value based on multiple events

larsxschneider — Sun, 28 Sep 2014 20:28:43 GMT

Awesome! Thank you very much!

Re: Calculate a value based on multiple events

martin_mueller — Sun, 28 Sep 2014 20:30:26 GMT

Gerne! 🙂