I have events that I need to split out according to an suffixed number on the end of the field names and then summarized with other events for the same Flow Name.

[pxs0514]

All of the fields ending in _1 need to be reported together, then all those ending in _2, etc. The number of suffixed metrics varies from event to event so it will need to be processed like an array until end of event is reached. Can you help?

1st Event Record of 8:
Broker Name: MQS9BRK
Execgrp: STG1TRN3
Flow Name: RetrieveClaimDetails
StartDate: 2016-08-29
StartTime: 10:00
MsgsProc: 34
(Unknown number of Nodes - metrics below associated with the above broker flow)
Nodename_1: AIPService
Nodename_2: COBOLtoKofax
Nodename_3: ClaimsReply
Nodename_4: CobolFault
Nodetype_1: ComputeNode
Nodetype_2: FlowOrderNode
Nodetype_3: SOAPExtractNode
Nodetype_4: ValidateNode
Msgs_1: 34
Msgs_2: 34
Msgs_3: 0
Msgs_4: 10
CPU_1: 46125
CPU_2: 5915
CPU_3: 721949
CPU_4: 0

Search criteria: Broker Name=MQS9BRK Execgrp=STG1TRN3
Flow Name=RetrieveClaimDetails
StartDate=2016-08-29 StartTime=10:00 EndTime=12:00 (need to evaluate a total of eight 15 minute intervals)

End result needed in table for the above search criteria

NodeName NodeType Msgs (sum of all intervals 10-12:00) CPU (sum of all intervals 10-12)
AIPService ComputeNode 272 2343209
COBOLtoKofax FlowOrderNode 272 16324
ClaimsReply SOAPExtractNode 272 983424032
CobolFault ValidateNode 0 0

[sundareshr]

Try this

your base search | extract pairdelim="\n" kvdelim=":" | eval time=strptime(StartDate."T".StartTime, "%Y-%m-%dT%H:%M") | rex max_match=0 field=_raw "Nodename_\d+:\s+(?<nodename>\w+)" | rex max_match=0 field=_raw "Nodetype_\d+:\s+(?<nodetype>\w+)" | rex max_match=0 field=_raw "Msgs_\d+:\s+(?<msgs>\w+)" | rex max_match=0 field=_raw "CPU_\d+:\s+(?<cpu>\w+)" | eval z=mvzip(nodename, mvzip(nodetype, mvzip(msgs, cpu))) | mvexpand z | bin span=15m time | stats sum(msgs) as Msgs sum(cpu) as CPU by time nodename nodetype