I have one source and I need to use the field values from multiple rows to come up with an average. I have the data already indexed by _time. The data is like this.
1:00:00 field1=value1 field2=value2
1:00:00 field1=value3 field2=value4
1:00:00 field1=value5 field2=value6
this repeats every 30 seconds. I need to calculate as follows for every 30 second span
(value2 + value4)/value6
I have tried using append, but I can't figure out how to use the renamed values of "field2" to perform the operation I need to do and then visualize the data.
Okay, based on the assumptions in the comments you can do this:
index=foo sourcetype=bar | eval value2 = case(field1=value1, field2) | eval value4 = case(field1=value3, field2) | eval value6 = case(field1=value5, field2) | stats values(value*) as value* by _time | eval result = (value2 + value4) / value6 | timechart span=30s avg(result)