Splunk: Stats from multiple events and expecting one combined output

0
votes

I have below events

event_a has time_a and MAS_A fields

event_b has time_b and MAS_B fields

event_c has time_c and MAS_C fields 

sourcetype="app" eventtype in (event_a,event_b,event_c) 
| stats avg(time_a) as "Avg Response Time" BY MAS_A 
| eval Avg Response Time=round('Avg Response Time',2)

Output I am getting from above search is two fields MAS_A and Avg Response Time

I am trying to get this for event_b and event_c as well in same search SPL and expecting final output with two fields only MAS_A_B_C and Avg Response Time

1
splunk

1 Answers

2
votes

Is this what you are after? Some sample events may help with your query.

sourcetype="app" eventtype in (event_a,event_b,event_c) 
| eval time_value=coalesce(time_a, time_b, time_c)
| eval MAS_value =coalesce(MAS_A,MAS_B,MAS_C)
| stats avg(time_value) as "Avg Response Time" BY MAS_value 
| eval Avg Response Time=round('Avg Response Time',2)