Splunk Search

How to add average column to timewrap table for multiple fields?

michaelsplunk1
Path Finder

Hi there!

I want to add columns to this table that I copied from the docs about timewrap. I want to add columns that have the averages for each field (accessories, sports, strategy, etc.) across the timewrapped columns. Basically, a column for the average of ACCESSORIES_S1, ACCESSORIES_S0, etc., and then a column for the average of SPORTS_S1, SPORTS_S0, etc., and a column for the average of STRATEGY_S1, STRATEGY_S0, etc.

michaelsplunk1_0-1647551329507.png

Additionally, I eventually want to use these averages as a trigger for an alert when the counts on these (i.e., accessories, sports, strategy, etc.) surpass the average. Long story short, I have an arbitrary number of fields, with a count on those fields, and I want to alert when the count on those fields exceeds the average, without having to set up multiple alerts for each field because I don't know what the fields are going to be ahead of time and the field names can change. 

@mattymo your multipart article on timewrap and Cyclical Statistical Forecasts and Anomalies has helped me so much, can you please help me on this application of timewrap?

Thank you!

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| foreach *_s*
    [| eval "<<MATCHSEG1>>_total"=if(isnull('<<FIELD>>'),'<<MATCHSEG1>>_total',if(isnull('<<MATCHSEG1>>_total'),'<<FIELD>>','<<MATCHSEG1>>_total'+'<<FIELD>>'))
    | eval "<<MATCHSEG1>>_count"=if(isnull('<<FIELD>>'),'<<MATCHSEG1>>_count',if(isnull('<<MATCHSEG1>>_count'),1,'<<MATCHSEG1>>_count'+1))]
| foreach *_total
    [| eval "<<MATCHSEG1>>_average"='<<MATCHSEG1>>_total'/'<<MATCHSEG1>>_count']

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| foreach *_s*
    [| eval "<<MATCHSEG1>>_total"=if(isnull('<<FIELD>>'),'<<MATCHSEG1>>_total',if(isnull('<<MATCHSEG1>>_total'),'<<FIELD>>','<<MATCHSEG1>>_total'+'<<FIELD>>'))
    | eval "<<MATCHSEG1>>_count"=if(isnull('<<FIELD>>'),'<<MATCHSEG1>>_count',if(isnull('<<MATCHSEG1>>_count'),1,'<<MATCHSEG1>>_count'+1))]
| foreach *_total
    [| eval "<<MATCHSEG1>>_average"='<<MATCHSEG1>>_total'/'<<MATCHSEG1>>_count']
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...