Splunk Search

How to add average column to timewrap table for multiple fields?

michaelsplunk1
Path Finder

Hi there!

I want to add columns to this table that I copied from the docs about timewrap. I want to add columns that have the averages for each field (accessories, sports, strategy, etc.) across the timewrapped columns. Basically, a column for the average of ACCESSORIES_S1, ACCESSORIES_S0, etc., and then a column for the average of SPORTS_S1, SPORTS_S0, etc., and a column for the average of STRATEGY_S1, STRATEGY_S0, etc.

michaelsplunk1_0-1647551329507.png

Additionally, I eventually want to use these averages as a trigger for an alert when the counts on these (i.e., accessories, sports, strategy, etc.) surpass the average. Long story short, I have an arbitrary number of fields, with a count on those fields, and I want to alert when the count on those fields exceeds the average, without having to set up multiple alerts for each field because I don't know what the fields are going to be ahead of time and the field names can change. 

@mattymo your multipart article on timewrap and Cyclical Statistical Forecasts and Anomalies has helped me so much, can you please help me on this application of timewrap?

Thank you!

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| foreach *_s*
    [| eval "<<MATCHSEG1>>_total"=if(isnull('<<FIELD>>'),'<<MATCHSEG1>>_total',if(isnull('<<MATCHSEG1>>_total'),'<<FIELD>>','<<MATCHSEG1>>_total'+'<<FIELD>>'))
    | eval "<<MATCHSEG1>>_count"=if(isnull('<<FIELD>>'),'<<MATCHSEG1>>_count',if(isnull('<<MATCHSEG1>>_count'),1,'<<MATCHSEG1>>_count'+1))]
| foreach *_total
    [| eval "<<MATCHSEG1>>_average"='<<MATCHSEG1>>_total'/'<<MATCHSEG1>>_count']

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| foreach *_s*
    [| eval "<<MATCHSEG1>>_total"=if(isnull('<<FIELD>>'),'<<MATCHSEG1>>_total',if(isnull('<<MATCHSEG1>>_total'),'<<FIELD>>','<<MATCHSEG1>>_total'+'<<FIELD>>'))
    | eval "<<MATCHSEG1>>_count"=if(isnull('<<FIELD>>'),'<<MATCHSEG1>>_count',if(isnull('<<MATCHSEG1>>_count'),1,'<<MATCHSEG1>>_count'+1))]
| foreach *_total
    [| eval "<<MATCHSEG1>>_average"='<<MATCHSEG1>>_total'/'<<MATCHSEG1>>_count']
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...