How to combine wildcard results into one field?

[splunklearner9]

index=perfmonitor sourcetype=dc_perfmonitor source="f:*"  
| fields + host, "*Processor Time"   
| stats avg("*Processor Time") by host 

The output of this query results in a long list of hosts with a staggered table of the average of each machine's average total processor time. I wanted to combine all of these results into a single column.

Basically, I wanted to ask how do I create a new field using this wildcard search (it has a space in its name), as something more general, like "ProcessorTime" vs. "Machine1 Processor Time", "Machine2 Processor Time", "Machine3 Processor Time", etc.?

[HiroshiSatoh]

Is this bad?

 | stats avg("*Processor Time")  as "*Processor Time" by host 

[micahkemp · Accepted solution]

You can do this with foreach, but you definitely want to strongly consider if it's the best solution.

Here's a run anywhere example of this in action:

| makeresults | eval field1="10", field2="20"
| foreach field* [eval fields=mvappend(fields, '<<FIELD>>')]
| stats avg(fields)

And your search may look like:

 index=perfmonitor sourcetype=dc_perfmonitor source="f:*"  
 | fields + host, "*Processor Time" 
 | foreach "*Processor Time" [eval all_processor_times=mvappend(all_processor_times, '<<FIELD>>')]
 | stats avg(all_processor_times) by host

You may want to include some more details about your source data to help determine if there's a more appropriate way to accomplish what you're looking for.

[splunklearner9]

This worked perfectly. Thanks! Never thought to do it like that.