Splunk:来自多个事件的统计信息，并期望一个组合输出

Question

我有以下事件

event_a具有time_a和MAS_A字段

event_b具有time_b和MAS_B字段

event_c具有time_c和MAS_C字段

sourcetype="app" eventtype in (event_a,event_b,event_c) 
| stats avg(time_a) as "Avg Response Time" BY MAS_A 
| eval Avg Response Time=round('Avg Response Time',2) 

我从上面的搜索中得到的输出是两个字段MAS_A和Avg Response Time

我正试图在同一搜索SPL中为event_b和event_c获得这一结果，并期望只有两个字段的最终输出MAS_A_B_C和Avg Response Time

Answer 1

这就是你想要的吗？一些示例事件可能有助于查询。

sourcetype="app" eventtype in (event_a,event_b,event_c) 
| eval time_value=coalesce(time_a, time_b, time_c)
| eval MAS_value =coalesce(MAS_A,MAS_B,MAS_C)
| stats avg(time_value) as "Avg Response Time" BY MAS_value 
| eval Avg Response Time=round('Avg Response Time',2)