Hi, Let's say I can get this table using some Splunk query. id stages 1 key1,100 key2,200 key3,300 2 key1,50 key2,150 key3,250 3 key1,150 key2,250 key3,350 Given this data I want the result, that is I want to reduce (average) over the keys. key avg key1 100 key2 200 key3 300 I tried to use mvexpand for this but Splunk runs out of memory and the results get truncated. So I want something more like a reduce function that can accumulate this mv field by key. Is this possible to do through a splunk query? Here is what I have tried: `data_source`
| fields id, stages{}.name as stage_name, somejson{}.duration as stage_duration
| eval stages=mvzip(stage_name, stage_duration)
| eval stages=mvfilter(match(stages, "key*"))
| mvexpand stages
| eval stages=split(stages, ",")
| eval stage_name=mvindex(stages,0)
| eval stage_duration=mvindex(stages,1)
| stats avg(stage_duration) by stage_name I want to do something more efficient than `mvexpand stages` that helps me do the reduction without blowing up memory.
... View more