Splunk Search

operations on field values within multiple rows of the same source

New Member

I have one source and I need to use the field values from multiple rows to come up with an average. I have the data already indexed by _time. The data is like this.

1:00:00 field1=value1 field2=value2
1:00:00 field1=value3 field2=value4
1:00:00 field1=value5 field2=value6

this repeats every 30 seconds. I need to calculate as follows for every 30 second span

(value2 + value4)/value6

I have tried using append, but I can't figure out how to use the renamed values of "field2" to perform the operation I need to do and then visualize the data.

Tags (3)
0 Karma

SplunkTrust
SplunkTrust

Okay, based on the assumptions in the comments you can do this:

index=foo sourcetype=bar | eval value2 = case(field1=value1, field2) | eval value4 = case(field1=value3, field2) | eval value6 = case(field1=value5, field2) | stats values(value*) as value* by _time | eval result = (value2 + value4) / value6 | timechart span=30s avg(result)

New Member

never mind, typo. I got it now. Thanks for your help.

0 Karma

SplunkTrust
SplunkTrust

You can leave off the final timechart and see if the intermediate values are calculated correctly.

0 Karma

New Member

Thanks!
I don't think anything is being calculated in result. Is there a way to test that part?
My result always comes up blank

0 Karma

New Member

that is correct

0 Karma

SplunkTrust
SplunkTrust

I see. Is it certain that these three events have the exact same timestamp and there is only one set of three for each timestamp?

0 Karma

New Member

by the values of field1

0 Karma

SplunkTrust
SplunkTrust

How do you identify the three different rows and their meaning?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!