Splunk Search

Create a new row based on two fields?

crt89
Communicator

Good day Splunkers,

I have this table example consisting of 4 fields naming (src_ip, start_time, time_delta, avg_bytes)

example:














src_ip start_time time_delta avg_bytes
1.2.3.4 1405305768 5 123.45



Now for the question, is it possible to create a new set of rows based on the fields start_time and time_delta? Where the number of this new rows is based on time_delta and the value of this row is start_time + 1. Looking at my example, we would create 4 new rows (based on time_delta-1) the values of this rows would be 1405305768,1405305769,1405305770,1405305771,1405305772

src_ip start_time time_delta avg_bytes
1.2.3.4 1405305768 5 123.45
1.2.3.4 1405305769 5 123.45
1.2.3.4 1405305770 5 123.45
1.2.3.4 1405305771 5 123.45
1.2.3.4 1405305772 5 123.45


I'm kinda lost now on my search, Is there a splunk search term for this kind of situation. It would be a great help.

Thanks !

Tags (3)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

What are you trying to do?

Append this to your search:

 ... | eval temp = mvrange(0,time_delta) | mvexpand temp | eval start_time = start_time + temp

Note, this will only work reasonably well for small positive values of time_delta.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

What are you trying to do?

Append this to your search:

 ... | eval temp = mvrange(0,time_delta) | mvexpand temp | eval start_time = start_time + temp

Note, this will only work reasonably well for small positive values of time_delta.

crt89
Communicator

Hi @martin_mueller the command works, I think I won't have a 50000 time delta. Thanks again, already marked your answer

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

50+ shouldn't be any issue. At some point you'll hit configured limits of mvexpand, that might be 50000 or so.

0 Karma

crt89
Communicator

Hi @martin_mueller, what I was trying to do is add some rows. What I have above is example of what output of report I would like to make. For your answer you have said that it will only work for some extent. I have time_delta values that ranges to 50+. But I will still try this and be back on the outcomes.

0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...