Splunk Search

how to combine/merge multiple generic fields/columns in one field/column with average calculation per generic field/column values in Splunk?

New Member


I have following situation in splunk (see picture below).
Actual Situation

I need following pattern in Splunk (see picture below).
Target Solution

I have different generic columns where the last part of the column-name (Suffix) is dynamic and unknown. I need to combine/merge this generic columns to one target-column. Within the target-column I want to calculate the average per generic field. I think the picture explains the situation very well.

0 Karma


Do you have a fixed number of suffixes? That is, are there only SuffixA, SuffixB and SuffixC?

0 Karma