Can I execute several functions with a single (perhaps custom) command?

[kamryn]

Based on the statistical data we have to generate, we normally have to type out many functions like so:

search string |stats median(a) as "The Median" stdev(a) as "Standard Deviation" min(a) as "Minimum" max(a) as "Maximum" range(a) as "The Range"

Is it possible to define a function to combine multiple functions to be ran at once?

For example something like:

SuperStats(a)

Then have it automatically display in the chart the other functions such as median, standard deviation, minimum, maximum and range?

I understand there are custom searches that can be created but I am not a programmer, if there's any other native options to take advantage of to perform this, I would like to look at them before attempting to go down that route.

I hope the wording in my question makes sense. Please let me know if you have any questions and thank you for any advice you might have to share.

[dmarling · Accepted solution]

you can create a search macro that has a variable passed into it. It would look like this when you set it up:

And when you execute a search it would look like this:

search string | `SuperStats(a)`

Here's a run anywhere example once you get it created:

index=_internal sourcetype="splunk_web_access"
| `SuperStats(bytes)`

Documentation is here: https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/Definesearchmacros

[kamryn]

This is exactly what I was looking for. Thank you so much.