Based on the statistical data we have to generate, we normally have to type out many functions like so:
search string |stats median(a) as "The Median" stdev(a) as "Standard Deviation" min(a) as "Minimum" max(a) as "Maximum" range(a) as "The Range"
Is it possible to define a function to combine multiple functions to be ran at once?
For example something like:
Then have it automatically display in the chart the other functions such as median, standard deviation, minimum, maximum and range?
I understand there are custom searches that can be created but I am not a programmer, if there's any other native options to take advantage of to perform this, I would like to look at them before attempting to go down that route.
I hope the wording in my question makes sense. Please let me know if you have any questions and thank you for any advice you might have to share.
you can create a search macro that has a variable passed into it. It would look like this when you set it up:
And when you execute a search it would look like this:
search string | `SuperStats(a)`
Here's a run anywhere example once you get it created:
index=_internal sourcetype="splunk_web_access" | `SuperStats(bytes)`
Documentation is here: https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/Definesearchmacros