topic How to do a common eval operation with dynamic field values? in Splunk Search

How to do a common eval operation with dynamic field values?

joydeep741 — Thu, 05 Jul 2018 15:58:32 GMT

I have a splunk query

index=abc sourcetype=xyz | timechart by field1

This gives me data like

_time column1 cloumn2 column3 ..... coulumnN

Now , I want to do a common eval operation on all of these columns. But I do not want to HARD CODE the column names (as I do not know before hand the values of field1)

Right now I am doing like this
index=abc sourcetype=xyz | timechart by field1 | eval column1= column1 + 100 | eval column2= column2 + 100 | eval coulmn3 = column3 +100........ and so on.

That way I am having multiple eval statements, even though I am performing the same operation eval column= column + 100

Can someone guide me a better approach of doing this?

Re: How to do a common eval operation with dynamic field values?

somesoni2 — Thu, 05 Jul 2018 16:04:06 GMT

You got forearch command for it. Try like this

index=abc sourcetype=xyz | timechart by field1
| foreach * [| eval "<<FIELD>>"='<<FIELD>>'+100]

Using * in foreach will process all fields whose name doesn't start with underscore (which are internal fields). The construct <<FIELD>> (used with double quotes in LHS of equal sign and used with single quotes on RHS, just in case column names may contain special characters) should be use as is. See this for more information:
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Foreach

Re: How to do a common eval operation with dynamic field values?

woodcock — Thu, 05 Jul 2018 16:09:48 GMT

You can iterate over fields with the foreach command:

... | foreach col* [ eval <<FIELD>> = <<FIELD>> + 100]