topic Re: How to combine wildcard results into one field? in Splunk Search

How to combine wildcard results into one field?

splunklearner9 — Wed, 10 Jan 2018 20:31:57 GMT

index=perfmonitor sourcetype=dc_perfmonitor source="f:*"  
| fields + host, "*Processor Time"   
| stats avg("*Processor Time") by host

The output of this query results in a long list of hosts with a staggered table of the average of each machine's average total processor time. I wanted to combine all of these results into a single column.

Basically, I wanted to ask how do I create a new field using this wildcard search (it has a space in its name), as something more general, like "ProcessorTime" vs. "Machine1 Processor Time", "Machine2 Processor Time", "Machine3 Processor Time", etc.?

Re: How to combine wildcard results into one field?

micahkemp — Thu, 11 Jan 2018 02:13:50 GMT

You can do this with foreach, but you definitely want to strongly consider if it's the best solution.

Here's a run anywhere example of this in action:

| makeresults | eval field1="10", field2="20"
| foreach field* [eval fields=mvappend(fields, '<<FIELD>>')]
| stats avg(fields)

And your search may look like:

 index=perfmonitor sourcetype=dc_perfmonitor source="f:*"  
 | fields + host, "*Processor Time" 
 | foreach "*Processor Time" [eval all_processor_times=mvappend(all_processor_times, '<<FIELD>>')]
 | stats avg(all_processor_times) by host

You may want to include some more details about your source data to help determine if there's a more appropriate way to accomplish what you're looking for.

Re: How to combine wildcard results into one field?

HiroshiSatoh — Thu, 11 Jan 2018 02:37:38 GMT

Is this bad?

 | stats avg("*Processor Time")  as "*Processor Time" by host

Re: How to combine wildcard results into one field?

splunklearner9 — Thu, 11 Jan 2018 22:16:21 GMT

This worked perfectly. Thanks! Never thought to do it like that.