Arithmetic on multi field values

[rtakatsuka]

I am new to Splunk, and I need to perform arithmetic on some multi-field values. What is the best way to do this? Here is an example of an event (where the "stuff" field is an array containing any number of key-value pairs with "A" and "B"):

   event1 {
         name:   foo
         stuff: [
            {
             A:  10 
             B:  220.0  
            }   
            {
             A:  2  
             B:  50.0   
            }   
        ]   
    }
   event2 {
         name:   foo
         stuff: [
            {
             A:  2  
             B:  100.0  
            }   
        ]   
    }

Here is the search I am using:

<my search>
| mvexpand stuff{} 
| rename stuff{}.* as *  
| eval test=B/A
| table _time A B test

However, test is empty whenever there is more than 1 "stuff" in my event. In the example above: test=null, null, 50

My goal is to calculate "test" so that: test=22, 25, 50

[to4kawa · Accepted solution]

your current result:

| makeresults 
| eval _raw="\"event1\":{\"name\":\"foo\",\"stuff\":[{\"A\":10,\"B\":220.0},{\"A\":2,\"B\":50.0}]}
\"event2\":{\"name\":\"foo\",\"stuff\":[{\"A\":2,\"B\":100.0}]}"
| makemv delim="
" _raw
| stats count by _raw
| rex "(?<json>{.*)"
| spath input=json
| rename stuff{}.* as *
| eval test=B / A
| table _time A B test

recommend:

your search
| rename stuff{}.* as *
| eval temp=mvzip(A,B)
| mvexpand temp
| table _time temp
| eval A = mvindex(split(temp,","),0), B = mvindex(split(temp,","),1), test = A / B
| table _time A B test

HI, how about this?