It would be much easier to describe the problem with illustrations/mockups of your input and desired output, and a description of the logic between illustrated input and desired output without SPL. ...
See more...
It would be much easier to describe the problem with illustrations/mockups of your input and desired output, and a description of the logic between illustrated input and desired output without SPL. I've got two servers providing me temperature data. Host A has Sensor1 and Sensor2. Host B has Sensor1 and Sensor2. Let me try to decipher the requirements. You have a dataset like _time host Sensor1 Sensor2 2024-06-05 12:00:00 HostA 45.5 48.1 2024-06-05 12:00:00 HostB 50.0 45.1 2024-06-05 12:20:00 HostA 46.8 47.4 2024-06-05 12:20:00 HostB 48.8 46.3 2024-06-05 12:40:00 HostA 45.8 48.6 2024-06-05 12:40:00 HostB 45.3 45.4 Your psuedo code suggests that Host A has Sensor1 in Room 12 and Sensor2 in Room 13. Host B has Sensor1 in Room 14 and Sensor2 in Room 15. You want something like the following: _time avg(Roome12) avg(Roome13) avg(Roome14) avg(Roome15) 2024-06-05 12:00:00 45.5 48.1 50.0 45.1 2024-06-05 12:20:00 46.8 47.4 48.8 46.3 2024-06-05 12:40:00 45.8 48.6 45.3 45.4 But your data doesn't directly give you the mapping. Is this correct? I lack the imagination of how this physical layout works, but in SPL, you can do something like index=tempmon sourcetype=tempdata
| eval "Room 12" = if(host == "HostA", Sensor1, null())
| eval "Room 13" = if(host == "HostA", Sensor2, null())
| eval "Room 14" = if(host == "HostB", Sensor1, null())
| eval "Room 15" = if(host == "HostB", Sensor2, null())
| timechart span=20min avg("Room 12"), avg("Room 13"), avg("Room 14"), avg("Room 15") You can play with the following emulation and compare with real data | makeresults format=csv data="_time,host,Sensor1,Sensor2
2024-06-05 12:00:00, HostA, 45.5,48.1
2024-06-05 12:00:00, HostB, 50.0,45.1
2024-06-05 12:20:00, HostA,46.8,47.4
2024-06-05 12:20:00, HostB,48.8,46.3
2024-06-05 12:40:00, HostA,45.8,48.6
2024-06-05 12:40:00, HostB,45.3,45.4"
| eval _time = strptime(_time, "%F %T")
``` the above emulates
index=tempmon sourcetype=tempdata
``` On the other hand, maybe you do not want to hard code the mapping. In that case, you can set up a lookup table like host Sensor Room hostA Sensor1 Room 12 hostA Sensor2 Room 13 hostB Sensor1 Room 14 hostB Sensor2 Room 15 Before I move on with SPL, it is important to understand what you really have in raw data. My mockup assumes that you have two separate fields Sensor1 and Sensor2. While this is a possible with some data sources, a more normalized data feed might give the following instead. _time host Sensor Temperature 2024-06-05 12:00:00 HostA Sensor1 45.5 2024-06-05 12:00:00 HostA Sensor2 48.1 2024-06-05 12:00:00 HostB Sensor1 50.0 2024-06-05 12:00:00 HostA Sensor2 45.1 2024-06-05 12:20:00 HostA Sensor1 46.8 2024-06-05 12:20:00 HostA Sensor2 47.4 2024-06-05 12:20:00 HostB Sensor1 48.8 2024-06-05 12:20:00 HostB Sensor2 46.3 2024-06-05 12:40:00 HostA Sensor1 45.8 2024-06-05 12:40:00 HostA Sensor2 48.6 2024-06-05 12:40:00 HostB Sensor1 45.3 2024-06-05 12:40:00 HostB Sensor2 45.4 Can you clarify which raw input format is yours? Emulation of the second format is | makeresults format=csv data="_time,host,Sensor,Temperature
2024-06-05 12:00:00, HostA,Sensor1, 45.5
2024-06-05 12:00:00, HostA,Sensor2,48.1
2024-06-05 12:00:00, HostB, Sensor1, 50.0
2024-06-05 12:00:00, HostA,Sensor2,45.1
2024-06-05 12:20:00, HostA,Sensor1,46.8
2024-06-05 12:20:00, HostA,Sensor2,47.4
2024-06-05 12:20:00, HostB,Sensor1,48.8
2024-06-05 12:20:00, HostB,Sensor2,46.3
2024-06-05 12:40:00, HostA,Sensor1,45.8
2024-06-05 12:40:00, HostA,Sensor2,48.6
2024-06-05 12:40:00, HostB,Sensor1,45.3
2024-06-05 12:40:00, HostB,Sensor2,45.4"
| eval _time = strptime(_time, "%F %T")
| table _time,host,Sensor,Temperature
``` the above emulates
index=tempmon sourcetype=tempdata
``````