I have event like
_time host1=1 host2=10 host3=20 _time host1=2 host3=12 host3=30
The number of fields is not defined, I only know they begin with host*
Is there a way to make an | eval sum=sum(host*) ?
In fact each host value is a percentage. And I would like to compute a 100% value from all the fields together :
...| eval sum=sum(host*) | eval nbfields=nbfields(host*) | eval usage=sum/nbfields
(I don't know if there is a nbfields like function