topic Compare search fields to add another field if they match in Splunk Search

Compare search fields to add another field if they match

danielsavage — Tue, 04 Jul 2017 07:39:40 GMT

So at the moment I have a simple search

index=index sourcetype="sourcetype"  host1 OR host2 | table hour day month AvgCpuPerc

And this returns results like
18:00 12th Friday June 22%
18:00 12th Friday June 48%
17:00 12th Friday June 19%
17:00 12th Friday June 41%

What I would like to do, is have the results like this, but instead of having duplicate dates, have only one result for each date with the AvgCpuPerc column added, to give a result like this

18:00 12th Friday June 70%
17:00 12th Friday June 60%

How do I do this?

Re: Compare search fields to add another field if they match

richgalloway — Tue, 04 Jul 2017 15:06:21 GMT

Try this.

index=index sourcetype="sourcetype"  host1 OR host2 | stats sum(AvgCpuPerc) as AvgCpuPerc by hour day month | table hour date month AvgCpuPerc

If the '%' character is part of the data then it will have to be removed for the stats command to work. Like this.

 index=index sourcetype="sourcetype"  host1 OR host2  | eval AvgCpuPerc=trim(AvgCpuPerc,"%") |  stats sum(AvgCpuPerc) as AvgCpuPerc by hour day month | eval AvgCpuPerc=AvgCpuPerc."%" | table hour date month AvgCpuPerc

Re: Compare search fields to add another field if they match

adonio — Tue, 04 Jul 2017 15:10:03 GMT

hello there,
looks like in your example you summed the percentages when saying you want average,
regardless, use stats command.

index=index sourcetype="sourcetype"  host1 OR host2 |stats avg(AvgCpuPerc) as hour_avg sum(AvgCpuPerc) as hour_sum by hour day month AvgCpuPerc

hope it helps