Splunk Search

How can I aggregate some values of a field and divide a list into 2 parts?

Jochen_1987
Explorer

I have 2 questions:
Is it possible to aggregate some values of a field into one value??
For example I have in the field "products" the values Mercedes,Ferrari,Porsche, apple,banana.... and I want to aggregate them in 2 values "cars" and "fruit"?!

And if I have a list with values from 2011 and 2012 is it possible to get for example the mean of 2011 and the mean of 2012 in ONE result table????

I'm new with Splunk so maybe my questions are too easy:-)

Tags (1)
0 Karma
1 Solution

ziegfried
Influencer

You can use the eval command to selectively create a field depending on its value:

... | eval car=if(match(product,"(?i)^(mercedes|ferrari|porsche)$"),null()) | eval fruit=if(match(product,"(?i)^(apple|banana)$"),null()) | stats values(car) values(fruit)

You can use the split-by clause in the stats command, to create an aggregated value for each year:

... | eval year=strftime(_time,"%Y") | stats mean(somefield) by year

Edit, to answer the question in the comment: yes, you can do something like this

... | eval type=case(match(product,"(?i)^(mercedes|ferrari|porsche)$"),"car",match(product,"(?i)^(apple|banana)$"),"fruit") | eval year=strftime(_time,"%Y") | chart mean(somefield) over type by year

View solution in original post

ziegfried
Influencer

You can use the eval command to selectively create a field depending on its value:

... | eval car=if(match(product,"(?i)^(mercedes|ferrari|porsche)$"),null()) | eval fruit=if(match(product,"(?i)^(apple|banana)$"),null()) | stats values(car) values(fruit)

You can use the split-by clause in the stats command, to create an aggregated value for each year:

... | eval year=strftime(_time,"%Y") | stats mean(somefield) by year

Edit, to answer the question in the comment: yes, you can do something like this

... | eval type=case(match(product,"(?i)^(mercedes|ferrari|porsche)$"),"car",match(product,"(?i)^(apple|banana)$"),"fruit") | eval year=strftime(_time,"%Y") | chart mean(somefield) over type by year

ziegfried
Influencer

yes, updated the anwer...

0 Karma

Jochen_1987
Explorer

thanks for your answer, but ist it also possible to get for example a table like this:
2011 2012
cars value1 value2
fruits value3 value4
... ... ...

???

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...