Dashboards & Visualizations

How can I complete many (70) similar transformations without doing it manually?

iKate
Builder

Hi guys,

1) I've got a table like this:

month       A1     A2    A3   ....  A70
2017.08     x1     y1    z1
2017.07     x2     y2    z2
2017.06     x3     y3    z3
...

2) Then it is transformed with some logic and formatting like:

A1=if(month>"2017.08", A1."(".A1/A1_plan.")", A1)
A2=if(month>"2017.08", A2."(".A2/A2_plan.")", A2)
...
A70

3) Then it is transposed and resulting table looks like:

     ... 2017.06    2017.07     2017.08 .....
A1       x11        x22         x33
A2       y11        y22         y33
A3       z11        z22         z33

How can I perform transformations from step 2 without making 70 evaluations? If I do it in one query Splunk Web crashes.. Evaluations are almost the same for different An.

If there is a parameter for a column names like $column_name$, this can solve the issue with just one string like:

$column_name$=if(month>"2017.08", $column_name$."(".$column_name$/$column_name$_plan.")", $column_name$)

Is there such token or how else the problem can be solved?

Thanks in advance!
Katerina

0 Karma
1 Solution

sbbadri
Motivator

may be try with foreach,

| foreach A* [eval <<FIELD>> = if(month>"2017.08", <<FIELD>>."(".<<FIELD>>/<<FIELD>>_plan.")", <<FIELD>>)

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I think the foreach command will help. Try this as a start.

... | foreach A* [eval <<FIELD>>=if(month>"2017.08", <<FIELD>>."(".<<FIELD>>/<<FIELD>>_plan.")", <<FIELD>>)]
---
If this reply helps you, an upvote would be appreciated.

iKate
Builder

Wow so many answers at once! Thanks for help, it works perfectly!

0 Karma

somesoni2
Revered Legend

Try the foreach command.

your search generating output as 1)
| foreach A* [| eval  "<<FIELD>>"=if(month>"2017.08", '<<FIELD>>'."(".'<<FIELD>>'/'<<FIELD>>_plan'.")", A1)]

Do you have fields A1_plan in your result set? If yes, then try this

your search generating output as 1)
| foreach A* [| eval  "<<FIELD>>"=if(month>"2017.08" AND NOT (like("<<FIELD>>","%_plan"), '<<FIELD>>'."(".'<<FIELD>>'/'<<FIELD>>_plan'.")", A1)]

iKate
Builder

Thanks, it works but @sbbadri was the first to answer)

0 Karma

sbbadri
Motivator

may be try with foreach,

| foreach A* [eval <<FIELD>> = if(month>"2017.08", <<FIELD>>."(".<<FIELD>>/<<FIELD>>_plan.")", <<FIELD>>)

iKate
Builder

Awesome! It does exactly what I need, thanks! Please post it as an answer and I'll mark it as accepted.

0 Karma

sbbadri
Motivator

Cool... Converted to answer

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>