topic Re: Splunk Simple Math Expression using Eval in Splunk Search

Splunk Simple Math Expression using Eval

plunkzombie — Mon, 11 Oct 2021 09:01:58 GMT

I need a way to evaluate a simple math expression.

The following query works, and expr evaluates to result with a value of 44.

But, I need to make the following type of query work.

| gentimes start=-1 | eval expr = "1*2+3*4+5*6" | table expr, $expr

Is there a way to do this ?

Thanks.

Re: Splunk Simple Math Expression using Eval

Alisher — Mon, 11 Oct 2021 10:07:09 GMT

Hello @plunkzombie,

It seems you just need to get rid of the quotation marks.

Try this:

| gentimes start=-1 | eval expr = 1*2+3*4+5*6

KR,
A.

Re: Splunk Simple Math Expression using Eval

plunkzombie — Mon, 11 Oct 2021 11:06:36 GMT

This was just an example to show the problem that I am facing.

In the real splunk query where I need to make this work, that 'expr' gets constructed as part of the query evaluation, and is different for different rows of the table. There is no "quotation" marks, and it is a string type.

Re: Splunk Simple Math Expression using Eval

ITWhisperer — Mon, 11 Oct 2021 11:25:10 GMT

Perhaps a bit convoluted by try something like this

| gentimes start=-1 | eval expr = "1*2+3*4+5*6" | foreach expr [| eval return_{<<FIELD>>} = <<FIELD>>] | foreach return_* [| eval return=<<MATCHSEG1>>]

Re: Splunk Simple Math Expression using Eval

plunkzombie — Mon, 11 Oct 2021 11:58:55 GMT

Thank you so much. This works!