Splunk Search

How can I aggregate some values of a field and divide a list into 2 parts?

Jochen_1987
Explorer

I have 2 questions:
Is it possible to aggregate some values of a field into one value??
For example I have in the field "products" the values Mercedes,Ferrari,Porsche, apple,banana.... and I want to aggregate them in 2 values "cars" and "fruit"?!

And if I have a list with values from 2011 and 2012 is it possible to get for example the mean of 2011 and the mean of 2012 in ONE result table????

I'm new with Splunk so maybe my questions are too easy:-)

Tags (1)
0 Karma
1 Solution

ziegfried
Influencer

You can use the eval command to selectively create a field depending on its value:

... | eval car=if(match(product,"(?i)^(mercedes|ferrari|porsche)$"),null()) | eval fruit=if(match(product,"(?i)^(apple|banana)$"),null()) | stats values(car) values(fruit)

You can use the split-by clause in the stats command, to create an aggregated value for each year:

... | eval year=strftime(_time,"%Y") | stats mean(somefield) by year

Edit, to answer the question in the comment: yes, you can do something like this

... | eval type=case(match(product,"(?i)^(mercedes|ferrari|porsche)$"),"car",match(product,"(?i)^(apple|banana)$"),"fruit") | eval year=strftime(_time,"%Y") | chart mean(somefield) over type by year

View solution in original post

ziegfried
Influencer

You can use the eval command to selectively create a field depending on its value:

... | eval car=if(match(product,"(?i)^(mercedes|ferrari|porsche)$"),null()) | eval fruit=if(match(product,"(?i)^(apple|banana)$"),null()) | stats values(car) values(fruit)

You can use the split-by clause in the stats command, to create an aggregated value for each year:

... | eval year=strftime(_time,"%Y") | stats mean(somefield) by year

Edit, to answer the question in the comment: yes, you can do something like this

... | eval type=case(match(product,"(?i)^(mercedes|ferrari|porsche)$"),"car",match(product,"(?i)^(apple|banana)$"),"fruit") | eval year=strftime(_time,"%Y") | chart mean(somefield) over type by year

ziegfried
Influencer

yes, updated the anwer...

0 Karma

Jochen_1987
Explorer

thanks for your answer, but ist it also possible to get for example a table like this:
2011 2012
cars value1 value2
fruits value3 value4
... ... ...

???

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...