Splunk Search

How to summarize a lot of fields with mvappend

takeru
New Member

I am trying to find the standard deviation from the postfix log.
I assume the following search sentence.

index=postfix earliest=-50d
| timechart span=1d count by fromaddress
| eval readable_time=strftime(_time, "%Y-%m-%d ")
| fields - NULL OTHER _time _span _spandays
| transpose 50
| rename "row " as day
| eval mvfield=mvappend(day1,day2,day3,day4,day5............)
| stats avg(mvfield) as avg stdev(mvfield) as std by column

Is there a way to more easily define day 1 to day 50?
| eval mvfield=mvappend(day1,day2,day3,day4,day5............)

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

index=postfix earliest=-50d
| timechart span=1d count by fromaddress
| eval readable_time=strftime(_time, "%Y-%m-%d ")
| fields - NULL OTHER _time _span _spandays
| transpose 50
| rename "row " as day
| eval mvfield=null() | foreach day* [eval mvfield=mvappend(mvfield,'<<FIELD>>')]
| stats avg(mvfield) as avg stdev(mvfield) as std by column

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try

index=postfix earliest=-50d
| timechart span=1d count by fromaddress
| eval readable_time=strftime(_time, "%Y-%m-%d ")
| fields - NULL OTHER _time _span _spandays
| transpose 50
| rename "row " as day
| eval mvfield=null() | foreach day* [eval mvfield=mvappend(mvfield,'<<FIELD>>')]
| stats avg(mvfield) as avg stdev(mvfield) as std by column
0 Karma

somesoni2
Revered Legend

Also, try this

index=postfix earliest=-50d
 | timechart span=1d count by fromaddress
 | eval readable_time=strftime(_time, "%Y-%m-%d ")
 | fields - NULL OTHER _time _span _spandays
| untable readable_time column valuefield
| stats avg(valuefield) stdev(valuefield) by column
0 Karma

takeru
New Member

The answer I was hoping for
Thank you!

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...