Splunk Search

How to create fields dynamically

wolfgangs
Engager

Hi,
I have events which contain 3 Fields: "StartDate", "Value_per_month" and "Nr_of_Month". They basically disclose some monthly financial flow which beginns at "StartDate" and ends after "Nr_of_Month".
The goal is to show a sum of "Value_per_month" for each month over all events.

In most cases the dates are in the future, so it will be a bit tricky to get this to work. However, at least a table view would be great and use some basic vizualisation on top. I thought I could create fields for each month, for example "value_yyyy-mm" and assign the value to each and then sum up the values in each field accross all events.
However I have not found a way to do this dynamically in a loop for X times, based on variable "Nr_of_Month".
I have checked combinations of eval, makeresults, foreach, gentimes, etc.

Any basic idea how to approach this would be welcome.
Many thanks in advance

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you give some sample events showing the issues you are dealing with?

0 Karma

wolfgangs
Engager

of course an example might tell more than a page of explanation, sorry for not adding initially 😉
imagine several contracts with monthly payment, one contract per event. First one runs for 6 month, second for 4 month

 StartDateValue of MonthNr_of month
event 15th Dec 20213.56
event 28th Jan 20221.54

 

my thoughts to add fields:

 2021-122022-012022-022022-032022-042022-05
event 13.53.53.53.53.53.5
event 2not existing1.51.51.51.5not existing

 

expected result:
I would like to see the payment to expect each month

Monthsum of Value
2021-123.5
2022-015
2022-025
2022-035
2022-045
2022-053.5

 

0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...