topic Re: Add a field that includes the length of the field values in Splunk Search

Add a field that includes the length of the field values

agodoy — Mon, 17 Jun 2013 19:27:20 GMT

I am using eval foo = mvcount(split(field,"")) to count the number of characters in a field at search time. Is there a place to put such a statement so that the field foo gets created for all events that contain that field?

Thanks

Re: Add a field that includes the length of the field values

kristian_kolb — Mon, 17 Jun 2013 20:03:10 GMT

I believe that you want to take a look at 'calculated fields', which lets you make this 'permanent' in a config file. So no need to put it as part of the search.

http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/definecalcfields

http://docs.splunk.com/Documentation/Splunk/5.0.3/admin/Propsconf

EVAL-<fieldname> = <eval statement>
* Use this to automatically run the <eval statement> and assign the 
  value of the output to <fieldname>.  This feature is referred to as 'calculated fields'.
* When multiple EVAL-* statements are specified, they behave as if 
  they are run in parallel, rather than in any particular sequence.  
  This means that if you have e.g. EVAL-x=y*2, EVAL-y=100, x will be 
  assigned the original value of y * 2, not the value of y after it is set to 100.
* All field calculations will done after field aliasing but before lookups.  This
  means you can lookup based on the value of a calculated field

Hope this helps,

Re: Add a field that includes the length of the field values

agodoy — Mon, 17 Jun 2013 20:09:58 GMT

Perfect. Thank you.

Re: Add a field that includes the length of the field values

kristian_kolb — Mon, 17 Jun 2013 20:31:56 GMT

You are aware of the len(x) function for eval?

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/CommonEvalFunctions

Re: Add a field that includes the length of the field values

agodoy — Mon, 17 Jun 2013 20:34:36 GMT

I was not. Thanks for bring it up. Will change it since it is more simple to use and produces the same results. Thanks again.