Splunk Search

How to create fields dynamically

wolfgangs
Engager

Hi,
I have events which contain 3 Fields: "StartDate", "Value_per_month" and "Nr_of_Month". They basically disclose some monthly financial flow which beginns at "StartDate" and ends after "Nr_of_Month".
The goal is to show a sum of "Value_per_month" for each month over all events.

In most cases the dates are in the future, so it will be a bit tricky to get this to work. However, at least a table view would be great and use some basic vizualisation on top. I thought I could create fields for each month, for example "value_yyyy-mm" and assign the value to each and then sum up the values in each field accross all events.
However I have not found a way to do this dynamically in a loop for X times, based on variable "Nr_of_Month".
I have checked combinations of eval, makeresults, foreach, gentimes, etc.

Any basic idea how to approach this would be welcome.
Many thanks in advance

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you give some sample events showing the issues you are dealing with?

0 Karma

wolfgangs
Engager

of course an example might tell more than a page of explanation, sorry for not adding initially 😉
imagine several contracts with monthly payment, one contract per event. First one runs for 6 month, second for 4 month

 StartDateValue of MonthNr_of month
event 15th Dec 20213.56
event 28th Jan 20221.54

 

my thoughts to add fields:

 2021-122022-012022-022022-032022-042022-05
event 13.53.53.53.53.53.5
event 2not existing1.51.51.51.5not existing

 

expected result:
I would like to see the payment to expect each month

Monthsum of Value
2021-123.5
2022-015
2022-025
2022-035
2022-045
2022-053.5

 

0 Karma
Get Updates on the Splunk Community!

Video | Tom’s Smartness Journey Continues

Remember Splunk Community member Tom Kopchak? If you caught the first episode of our Smartness interview ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud? Learn how unique features like ...

Leverage Cisco Talos Threat Intelligence Across Splunk Security Products

Leverage Cisco Talos Threat Intelligence Across Splunk Security Products   Security Edition   Have you ...