Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: enumerating field names as a new field
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Dear all,
I have in splunk events of this simple structure fileldX=value, like
field1=..., field2=..., ... fieldN=...
Now I need to plot a stats of my data, something like
| chart avg(?), max(?) over field1, field2,.. fieldN
How should I express the '?'?
Do I need to create a syntetic field with values of my real filed names?
Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did it with append:
search ... | chart avg(field1) as f1, avg(field2) as f2 ... | append [ search ... | chart max(field1) as f1, max(field2) as f2... ] | transpose | rename ...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did it with append:
search ... | chart avg(field1) as f1, avg(field2) as f2 ... | append [ search ... | chart max(field1) as f1, max(field2) as f2... ] | transpose | rename ...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
good Mr akazarov
i don't think like that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Try to enumerate with this: |eval new=mvappend(field1,mvappend(field2,mvappend(field3,field4)))... | makemv delim="," new
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try like this:
...| chart avg(field*), max(field*) over field1, field2,.. fieldN
or
...| chart avg(*), max(*) over field1, field2,.. fieldN
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
over field1, field2
is not valid syntax, it says
Error in 'chart' command: Invalid argument: 'field2'
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
