How can I aggregate some values of a field and divide a list into 2 parts?

[Jochen_1987]

I have 2 questions:
Is it possible to aggregate some values of a field into one value??
For example I have in the field "products" the values Mercedes,Ferrari,Porsche, apple,banana.... and I want to aggregate them in 2 values "cars" and "fruit"?!

And if I have a list with values from 2011 and 2012 is it possible to get for example the mean of 2011 and the mean of 2012 in ONE result table????

I'm new with Splunk so maybe my questions are too easy:-)

[ziegfried · Accepted solution]

You can use the eval command to selectively create a field depending on its value:

... | eval car=if(match(product,"(?i)^(mercedes|ferrari|porsche)$"),null()) | eval fruit=if(match(product,"(?i)^(apple|banana)$"),null()) | stats values(car) values(fruit)

You can use the split-by clause in the stats command, to create an aggregated value for each year:

... | eval year=strftime(_time,"%Y") | stats mean(somefield) by year

Edit, to answer the question in the comment: yes, you can do something like this

... | eval type=case(match(product,"(?i)^(mercedes|ferrari|porsche)$"),"car",match(product,"(?i)^(apple|banana)$"),"fruit") | eval year=strftime(_time,"%Y") | chart mean(somefield) over type by year

[ziegfried]

yes, updated the anwer...

[Jochen_1987]

thanks for your answer, but ist it also possible to get for example a table like this:
2011 2012
cars value1 value2
fruits value3 value4
... ... ...

???