Splunk Search

How to construct columns with the same data, and then use these pseudo columns to calculate

flzhang132
Explorer

I want to get data ,as following
alt text

How to construct columns with the same data, and then use these pseudo columns to calculate in splunk ?

Tags (2)
0 Karma
1 Solution

adonio
Ultra Champion

hello there,

here is an example with search and eval

... search that captures fields project and pfee ...
| eventstats sum(pfee) as total 
| table project pfee 
| eventstats sum(pfee) as total
| eval other = if(project="other",pfee,null())
| eventstats max(other) as other
| eval total_minus_other = total - other
| eval ratio = round(pfee/total_minus_other, 2)
| eval pfee_plus_pfee_times_ratio = pfee + pfee*ratio

here is a sample to run anywhere:

| makeresults count=1 
| eval data = "p1,1;p2,2;p3,3;p4,10;p5,20;other,30"
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<project>\S+)\,(?<pfee>\d{1,5})"
| table project pfee
| eventstats sum(pfee) as total
| eval other = if(project="other",pfee,null())
| eventstats max(other) as other
| eval total_minus_other = total - other
| eval ratio = round(pfee/total_minus_other, 2)
| eval pfee_plus_pfee_times_ratio = pfee + pfee*ratio

hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

hello there,

here is an example with search and eval

... search that captures fields project and pfee ...
| eventstats sum(pfee) as total 
| table project pfee 
| eventstats sum(pfee) as total
| eval other = if(project="other",pfee,null())
| eventstats max(other) as other
| eval total_minus_other = total - other
| eval ratio = round(pfee/total_minus_other, 2)
| eval pfee_plus_pfee_times_ratio = pfee + pfee*ratio

here is a sample to run anywhere:

| makeresults count=1 
| eval data = "p1,1;p2,2;p3,3;p4,10;p5,20;other,30"
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<project>\S+)\,(?<pfee>\d{1,5})"
| table project pfee
| eventstats sum(pfee) as total
| eval other = if(project="other",pfee,null())
| eventstats max(other) as other
| eval total_minus_other = total - other
| eval ratio = round(pfee/total_minus_other, 2)
| eval pfee_plus_pfee_times_ratio = pfee + pfee*ratio

hope it helps

0 Karma

flzhang132
Explorer

you are great , thank you very much

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Can you clarify which fields exists already, and which fields you are trying to construct?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...