topic Re: operations on field values within multiple rows of the same source in Splunk Search

operations on field values within multiple rows of the same source

trailhead26 — Mon, 16 Jun 2014 17:48:06 GMT

I have one source and I need to use the field values from multiple rows to come up with an average. I have the data already indexed by _time. The data is like this.

1:00:00 field1=value1 field2=value2
1:00:00 field1=value3 field2=value4
1:00:00 field1=value5 field2=value6

this repeats every 30 seconds. I need to calculate as follows for every 30 second span

(value2 + value4)/value6

I have tried using append, but I can't figure out how to use the renamed values of "field2" to perform the operation I need to do and then visualize the data.

Re: operations on field values within multiple rows of the same source

martin_mueller — Mon, 16 Jun 2014 18:12:21 GMT

How do you identify the three different rows and their meaning?

Re: operations on field values within multiple rows of the same source

trailhead26 — Mon, 16 Jun 2014 18:14:02 GMT

by the values of field1

Re: operations on field values within multiple rows of the same source

martin_mueller — Mon, 16 Jun 2014 18:15:25 GMT

I see. Is it certain that these three events have the exact same timestamp and there is only one set of three for each timestamp?

Re: operations on field values within multiple rows of the same source

trailhead26 — Mon, 16 Jun 2014 18:16:16 GMT

that is correct

Re: operations on field values within multiple rows of the same source

martin_mueller — Mon, 16 Jun 2014 18:45:19 GMT

Okay, based on the assumptions in the comments you can do this:

index=foo sourcetype=bar | eval value2 = case(field1=value1, field2) | eval value4 = case(field1=value3, field2) | eval value6 = case(field1=value5, field2) | stats values(value*) as value* by _time | eval result = (value2 + value4) / value6 | timechart span=30s avg(result)

Re: operations on field values within multiple rows of the same source

trailhead26 — Mon, 16 Jun 2014 19:36:22 GMT

Thanks!
I don't think anything is being calculated in result. Is there a way to test that part?
My result always comes up blank

Re: operations on field values within multiple rows of the same source

martin_mueller — Mon, 16 Jun 2014 20:19:05 GMT

You can leave off the final timechart and see if the intermediate values are calculated correctly.

Re: operations on field values within multiple rows of the same source

trailhead26 — Mon, 16 Jun 2014 20:56:51 GMT

never mind, typo. I got it now. Thanks for your help.