Splunk Search

Compare search fields to add another field if they match

danielsavage
New Member

So at the moment I have a simple search

index=index sourcetype="sourcetype"  host1 OR host2 | table hour day month AvgCpuPerc

And this returns results like
18:00 12th Friday June 22%
18:00 12th Friday June 48%
17:00 12th Friday June 19%
17:00 12th Friday June 41%

What I would like to do, is have the results like this, but instead of having duplicate dates, have only one result for each date with the AvgCpuPerc column added, to give a result like this

18:00 12th Friday June 70%
17:00 12th Friday June 60%

How do I do this?

Tags (2)
0 Karma

adonio
Ultra Champion

hello there,
looks like in your example you summed the percentages when saying you want average,
regardless, use stats command.

index=index sourcetype="sourcetype"  host1 OR host2 |stats avg(AvgCpuPerc) as hour_avg sum(AvgCpuPerc) as hour_sum by hour day month AvgCpuPerc

hope it helps

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this.

index=index sourcetype="sourcetype"  host1 OR host2 | stats sum(AvgCpuPerc) as AvgCpuPerc by hour day month | table hour date month AvgCpuPerc

If the '%' character is part of the data then it will have to be removed for the stats command to work. Like this.

 index=index sourcetype="sourcetype"  host1 OR host2  | eval AvgCpuPerc=trim(AvgCpuPerc,"%") |  stats sum(AvgCpuPerc) as AvgCpuPerc by hour day month | eval AvgCpuPerc=AvgCpuPerc."%" | table hour date month AvgCpuPerc
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...