Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

sum an unknown number of fields (with wildcards)

$
0
0

I have event like

_time host1=1 host2=10 host3=20 _time host1=2 host3=12 host3=30

The number of fields is not defined, I only know they begin with host*

Is there a way to make an | eval sum=sum(host*) ?

In fact each host value is a percentage. And I would like to compute a 100% value from all the fields together :

...| eval sum=sum(host*) | eval nbfields=nbfields(host*) | eval usage=sum/nbfields

(I don't know if there is a nbfields like function


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>