topic Re: Converting from KB to GB in Splunk Search

Converting from KB to GB

carlyleadmin — Thu, 21 Dec 2017 15:52:36 GMT

Hi All,

i have search that brings data from C and D Drives and results are in KB so i want to convert those fields to GB.

index="main" host="hc1xrds01" Name="C:" OR Name="D:" FreeSpace |eval FreeSpace = round((FreeSpace/1024/1024/1024), 2)

I still have fields after the conversion in kbs.and even after eval i get another "FreeSpace" field with GB the other FreeSpace taht is highligted is still in KB.how do i change all that to GB?not just the FreeSpace,size and Raw as well which i believe is the top value.

do i have to change the way i get the data?

Thanks Alot

Re: Converting from KB to GB

pradeepkumarg — Thu, 21 Dec 2017 16:06:36 GMT

Your eval statement creates a new search time field. The raw data is not altered. What you see on the top is your actual raw data. To avoid confusion, name your new field different

|eval FreeSpace_GB = round((FreeSpace/1024/1024/1024)

Re: Converting from KB to GB

mayurr98 — Tue, 29 Sep 2020 17:20:59 GMT

Hey
What you have written is correct
Evaluation functions does not change your raw data.It just creates a new field which you can use it further for analysis.

index="main" host="hc1xrds01" Name="C:" OR Name="D:" FreeSpace |eval FreeSpace_in_GB = round((FreeSpace/1024/1024/1024), 2)

FreeSpace_in_GB is the new field created by this search. Use this field for your analysis and not the one which you see FreeSpace.

Let me know if it helps you!

Re: Converting from KB to GB

carlyleadmin — Tue, 29 Sep 2020 17:21:05 GMT

That worked thanks.so i wanto make a dashboard from these results but i am having hard time .when i select visualization the data it shows is cropped and not showing all the drives.can you help me with that?if i need to create another thread for it,i can do it.Thanks for all the help

index="main" host="hc1aptr3sv" Name="C:" OR Name="D:" FreeSpace | eval FreeSpace_in_GB = round((FreeSpace/1024/1024/1024), 2)|eval Size_in_GB = round((Size/1024/1024/1024),2)|table host,Name,Size_in_GB,FreeSpace_in_GB| dedup Name