I am new to Splunk, and I need to perform arithmetic on some multi-field values. What is the best way to do this? Here is an example of an event (where the "stuff" field is an array containing any number of key-value pairs with "A" and "B"):
event1 {
name: foo
stuff: [
{
A: 10
B: 220.0
}
{
A: 2
B: 50.0
}
]
}
event2 {
name: foo
stuff: [
{
A: 2
B: 100.0
}
]
}
Here is the search I am using:
<my search>
| mvexpand stuff{}
| rename stuff{}.* as *
| eval test=B/A
| table _time A B test
However, test is empty whenever there is more than 1 "stuff" in my event. In the example above: test=null, null, 50
My goal is to calculate "test" so that: test=22, 25, 50
your current result:
| makeresults
| eval _raw="\"event1\":{\"name\":\"foo\",\"stuff\":[{\"A\":10,\"B\":220.0},{\"A\":2,\"B\":50.0}]}
\"event2\":{\"name\":\"foo\",\"stuff\":[{\"A\":2,\"B\":100.0}]}"
| makemv delim="
" _raw
| stats count by _raw
| rex "(?<json>{.*)"
| spath input=json
| rename stuff{}.* as *
| eval test=B / A
| table _time A B test
recommend:
your search
| rename stuff{}.* as *
| eval temp=mvzip(A,B)
| mvexpand temp
| table _time temp
| eval A = mvindex(split(temp,","),0), B = mvindex(split(temp,","),1), test = A / B
| table _time A B test
HI, how about this?
your current result:
| makeresults
| eval _raw="\"event1\":{\"name\":\"foo\",\"stuff\":[{\"A\":10,\"B\":220.0},{\"A\":2,\"B\":50.0}]}
\"event2\":{\"name\":\"foo\",\"stuff\":[{\"A\":2,\"B\":100.0}]}"
| makemv delim="
" _raw
| stats count by _raw
| rex "(?<json>{.*)"
| spath input=json
| rename stuff{}.* as *
| eval test=B / A
| table _time A B test
recommend:
your search
| rename stuff{}.* as *
| eval temp=mvzip(A,B)
| mvexpand temp
| table _time temp
| eval A = mvindex(split(temp,","),0), B = mvindex(split(temp,","),1), test = A / B
| table _time A B test
HI, how about this?