How to construct columns with the same data, and then use these pseudo columns to calculate

[flzhang132]

I want to get data ,as following

How to construct columns with the same data, and then use these pseudo columns to calculate in splunk ？

[adonio · Accepted solution]

hello there,

here is an example with search and eval

... search that captures fields project and pfee ...
| eventstats sum(pfee) as total 
| table project pfee 
| eventstats sum(pfee) as total
| eval other = if(project="other",pfee,null())
| eventstats max(other) as other
| eval total_minus_other = total - other
| eval ratio = round(pfee/total_minus_other, 2)
| eval pfee_plus_pfee_times_ratio = pfee + pfee*ratio

here is a sample to run anywhere:

| makeresults count=1 
| eval data = "p1,1;p2,2;p3,3;p4,10;p5,20;other,30"
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<project>\S+)\,(?<pfee>\d{1,5})"
| table project pfee
| eventstats sum(pfee) as total
| eval other = if(project="other",pfee,null())
| eventstats max(other) as other
| eval total_minus_other = total - other
| eval ratio = round(pfee/total_minus_other, 2)
| eval pfee_plus_pfee_times_ratio = pfee + pfee*ratio

hope it helps

[flzhang132]

you are great , thank you very much

[kmorris_splunk]

Can you clarify which fields exists already, and which fields you are trying to construct?