Splunk Search

sum an unknown number of fields (with wildcards)

sbsbb
Builder

I have event like

_time host1=1 host2=10 host3=20
_time host1=2 host3=12 host3=30

The number of fields is not defined, I only know they begin with host*

Is there a way to make an | eval sum=sum(host*) ?

In fact each host value is a percentage. And I would like to compute a 100% value from all the fields together :

...| eval sum=sum(host*) | eval nbfields=nbfields(host*) | eval usage=sum/nbfields

(I don't know if there is a nbfields like function

Tags (3)
1 Solution

lguinn2
Legend

Try this

yoursearchhere
| addtotals host* fieldname=hostTotal
| eval fieldCount = 0
| foreach host* [ eval fieldCount = fieldCount + 1 ]
| eval usage = hostTotal / fieldCount

View solution in original post

somesoni2
Revered Legend

Another option-

your base search | rex max_match=0 "host[0-9]+=(?<HostValue>[^ ]+)" | eval fieldCount=mvcount(HostValue) | addtotals host* fieldname=hostTotal | eval avgHostValue=hostTotal/fieldCount

sbsbb
Builder

Thank you, that solution is very interesting too, I'll try both to see which runs quicker.

0 Karma

bhgupta
Engager

addtotals served my use case, thanks 🙂

0 Karma

lguinn2
Legend

Try this

yoursearchhere
| addtotals host* fieldname=hostTotal
| eval fieldCount = 0
| foreach host* [ eval fieldCount = fieldCount + 1 ]
| eval usage = hostTotal / fieldCount

aholzer
Motivator

You may want to look at addtotals command. This will only work if the host* fields are the only numeric fields in your events.

Hope this helps

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...