Splunk Search

Arithmetic on multi field values

rtakatsuka
Engager

I am new to Splunk, and I need to perform arithmetic on some multi-field values. What is the best way to do this? Here is an example of an event (where the "stuff" field is an array containing any number of key-value pairs with "A" and "B"):

   event1 {
         name:   foo
         stuff: [
            {
             A:  10 
             B:  220.0  
            }   
            {
             A:  2  
             B:  50.0   
            }   
        ]   
    }
   event2 {
         name:   foo
         stuff: [
            {
             A:  2  
             B:  100.0  
            }   
        ]   
    }

Here is the search I am using:

<my search>
| mvexpand stuff{} 
| rename stuff{}.* as *  
| eval test=B/A
| table _time A B test

However, test is empty whenever there is more than 1 "stuff" in my event. In the example above: test=null, null, 50

My goal is to calculate "test" so that: test=22, 25, 50

0 Karma
1 Solution

to4kawa
Ultra Champion

your current result:

| makeresults 
| eval _raw="\"event1\":{\"name\":\"foo\",\"stuff\":[{\"A\":10,\"B\":220.0},{\"A\":2,\"B\":50.0}]}
\"event2\":{\"name\":\"foo\",\"stuff\":[{\"A\":2,\"B\":100.0}]}"
| makemv delim="
" _raw
| stats count by _raw
| rex "(?<json>{.*)"
| spath input=json
| rename stuff{}.* as *
| eval test=B / A
| table _time A B test

recommend:

your search
| rename stuff{}.* as *
| eval temp=mvzip(A,B)
| mvexpand temp
| table _time temp
| eval A = mvindex(split(temp,","),0), B = mvindex(split(temp,","),1), test = A / B
| table _time A B test

HI, how about this?

View solution in original post

0 Karma

to4kawa
Ultra Champion

your current result:

| makeresults 
| eval _raw="\"event1\":{\"name\":\"foo\",\"stuff\":[{\"A\":10,\"B\":220.0},{\"A\":2,\"B\":50.0}]}
\"event2\":{\"name\":\"foo\",\"stuff\":[{\"A\":2,\"B\":100.0}]}"
| makemv delim="
" _raw
| stats count by _raw
| rex "(?<json>{.*)"
| spath input=json
| rename stuff{}.* as *
| eval test=B / A
| table _time A B test

recommend:

your search
| rename stuff{}.* as *
| eval temp=mvzip(A,B)
| mvexpand temp
| table _time temp
| eval A = mvindex(split(temp,","),0), B = mvindex(split(temp,","),1), test = A / B
| table _time A B test

HI, how about this?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...