Splunk Search

## Arithmetic on multi field values Engager

I am new to Splunk, and I need to perform arithmetic on some multi-field values. What is the best way to do this? Here is an example of an event (where the "stuff" field is an array containing any number of key-value pairs with "A" and "B"):

``````   event1 {
name:   foo
stuff: [
{
A:  10
B:  220.0
}
{
A:  2
B:  50.0
}
]
}
event2 {
name:   foo
stuff: [
{
A:  2
B:  100.0
}
]
}
``````

Here is the search I am using:

``````<my search>
| mvexpand stuff{}
| rename stuff{}.* as *
| eval test=B/A
| table _time A B test
``````

However, test is empty whenever there is more than 1 "stuff" in my event. In the example above: test=null, null, 50

My goal is to calculate "test" so that: test=22, 25, 50

Tags (5)
1 Solution  SplunkTrust

your current result:

``````| makeresults
| eval _raw="\"event1\":{\"name\":\"foo\",\"stuff\":[{\"A\":10,\"B\":220.0},{\"A\":2,\"B\":50.0}]}
\"event2\":{\"name\":\"foo\",\"stuff\":[{\"A\":2,\"B\":100.0}]}"
| makemv delim="
" _raw
| stats count by _raw
| rex "(?<json>{.*)"
| spath input=json
| rename stuff{}.* as *
| eval test=B / A
| table _time A B test
``````

recommend:

``````your search
| rename stuff{}.* as *
| eval temp=mvzip(A,B)
| mvexpand temp
| table _time temp
| eval A = mvindex(split(temp,","),0), B = mvindex(split(temp,","),1), test = A / B
| table _time A B test
``````

HI, how about this?  SplunkTrust

your current result:

``````| makeresults
| eval _raw="\"event1\":{\"name\":\"foo\",\"stuff\":[{\"A\":10,\"B\":220.0},{\"A\":2,\"B\":50.0}]}
\"event2\":{\"name\":\"foo\",\"stuff\":[{\"A\":2,\"B\":100.0}]}"
| makemv delim="
" _raw
| stats count by _raw
| rex "(?<json>{.*)"
| spath input=json
| rename stuff{}.* as *
| eval test=B / A
| table _time A B test
``````

recommend:

``````your search
| rename stuff{}.* as *
| eval temp=mvzip(A,B)
| mvexpand temp
| table _time temp
| eval A = mvindex(split(temp,","),0), B = mvindex(split(temp,","),1), test = A / B
| table _time A B test
``````

HI, how about this? Take the 2021 Splunk Career Survey

### Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey.Earn \$50 in Amazon cash! Full Details! >

Get Updates on the Splunk Community!