Splunk Search

How to create fields dynamically

wolfgangs
Engager

Hi,
I have events which contain 3 Fields: "StartDate", "Value_per_month" and "Nr_of_Month". They basically disclose some monthly financial flow which beginns at "StartDate" and ends after "Nr_of_Month".
The goal is to show a sum of "Value_per_month" for each month over all events.

In most cases the dates are in the future, so it will be a bit tricky to get this to work. However, at least a table view would be great and use some basic vizualisation on top. I thought I could create fields for each month, for example "value_yyyy-mm" and assign the value to each and then sum up the values in each field accross all events.
However I have not found a way to do this dynamically in a loop for X times, based on variable "Nr_of_Month".
I have checked combinations of eval, makeresults, foreach, gentimes, etc.

Any basic idea how to approach this would be welcome.
Many thanks in advance

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you give some sample events showing the issues you are dealing with?

0 Karma

wolfgangs
Engager

of course an example might tell more than a page of explanation, sorry for not adding initially 😉
imagine several contracts with monthly payment, one contract per event. First one runs for 6 month, second for 4 month

 StartDateValue of MonthNr_of month
event 15th Dec 20213.56
event 28th Jan 20221.54

 

my thoughts to add fields:

 2021-122022-012022-022022-032022-042022-05
event 13.53.53.53.53.53.5
event 2not existing1.51.51.51.5not existing

 

expected result:
I would like to see the payment to expect each month

Monthsum of Value
2021-123.5
2022-015
2022-025
2022-035
2022-045
2022-053.5

 

0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...