Splunk Search

operations on field values within multiple rows of the same source

trailhead26
New Member

I have one source and I need to use the field values from multiple rows to come up with an average. I have the data already indexed by _time. The data is like this.

1:00:00 field1=value1 field2=value2
1:00:00 field1=value3 field2=value4
1:00:00 field1=value5 field2=value6

this repeats every 30 seconds. I need to calculate as follows for every 30 second span

(value2 + value4)/value6

I have tried using append, but I can't figure out how to use the renamed values of "field2" to perform the operation I need to do and then visualize the data.

Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Okay, based on the assumptions in the comments you can do this:

index=foo sourcetype=bar | eval value2 = case(field1=value1, field2) | eval value4 = case(field1=value3, field2) | eval value6 = case(field1=value5, field2) | stats values(value*) as value* by _time | eval result = (value2 + value4) / value6 | timechart span=30s avg(result)

trailhead26
New Member

never mind, typo. I got it now. Thanks for your help.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can leave off the final timechart and see if the intermediate values are calculated correctly.

0 Karma

trailhead26
New Member

Thanks!
I don't think anything is being calculated in result. Is there a way to test that part?
My result always comes up blank

0 Karma

trailhead26
New Member

that is correct

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I see. Is it certain that these three events have the exact same timestamp and there is only one set of three for each timestamp?

0 Karma

trailhead26
New Member

by the values of field1

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

How do you identify the three different rows and their meaning?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...