Splunk Search
Highlighted

Find percentage between two fields whose name will fall into a naming convention

Contributor

I have a set of fixed fields that define a maximum threshold with the naming convention of "resourcesavailable[[convention]]"

and I have a variable set of fields which define a process consumption that will reference the naming convention like "resourceslisted[[convention]]"

The convention portion of the field names matches, but while one is fixed, the other will be based on whatever work is going on at the time. I'm trying to figure out how to calculate an evaluated percentage in time per convention (resourceslisted[[convention]])*(resourcesavailable[[convention]])/100 and the SPL to do this is just not coming to me...

Scenario example is I can get 30 events in, each with different values:
_time=now

resourcelisteda=23

resourcelistedb=9839

resourcelisteda=102

resourcelistedb=1

resourcelistedcde=1200

While I have a static condition of

resourcesavailablea=9201
resourcesavailableb=50
resourcesavailablecde=1

I want based on the event indexed: eval percentconsumed[[convention]]=resourcelisted[[convention]]*resourcesavailable[[convention]]/100

Is this even possible?

Tags (3)
0 Karma
Highlighted

Re: Find percentage between two fields whose name will fall into a naming convention

SplunkTrust
SplunkTrust

You'd probably use foreach command here. Try like this

your current search which includes fields resource_listed_* andn resource_available_*
| foreach resource_listed_* [eval "percent_consumed_<<MATCHSTR>>"='resource_listed_<<MATCHSTR>>'*'resources_available_<<MATCHSTR>>'/100]

The <<MATCHSTR>> and single quotes are to be used exactly as specified above (literal string).

0 Karma