topic Re: Calculations During Log File Ingest in Getting Data In

Calculations During Log File Ingest

notnavi — Thu, 10 Jul 2014 14:13:26 GMT

Is it possible to execute a calculation during log file ingest based on two fields in the log file with the result of the calculation placed in a new field?

My Splunk admin states that is not possible, but seems too simple a function to be able to do.

Re: Calculations During Log File Ingest

richgalloway — Thu, 10 Jul 2014 15:00:25 GMT

Add EVAL statements to your props.conf file. See http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Propsconf

Re: Calculations During Log File Ingest

somesoni2 — Thu, 10 Jul 2014 15:08:01 GMT

Another link with steps to add eval (calculated fields) from UI and props.conf

http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/definecalcfields

Re: Calculations During Log File Ingest

martin_mueller — Thu, 10 Jul 2014 16:46:48 GMT

Do note though, calculated fields are not calculated during log file ingest / at index time but rather at search time.

At index time you're stuck with regular expressions, which do not have the power to do maths.