topic Re: Create multiple eval fields with wilcards? in Splunk Search

Create multiple eval fields with wilcards?

jweinstein — Mon, 01 Apr 2013 20:49:56 GMT

I'm attempting to calculate the deltas between a field and it's historical value. I use a subquery w/ appendcols to return the historical data and it is nicely in the form:

Group, field1, field2, field1_historical, field2_historical

I can create the deltas with:

 | eval field1_delta = field1 - field1_historical
 | eval field2_delta = field2 - field2_historical

This works but I'd like to generalize it:

| eval *_delta = * - *_historical

but I get the error:

Error in 'eval' command: The expression is malformed. An unexpected character is reached at '* - *_historical'.

Any tips?

Re: Create multiple eval fields with wilcards?

gkanapathy — Mon, 01 Apr 2013 21:12:21 GMT

Sorry, no. You'll just have to type it out. You can try using a macro to shorten your typing, but you're still going to have to specify the field base names.

Re: Create multiple eval fields with wilcards?

martin_mueller — Mon, 01 Apr 2013 22:49:22 GMT

An alternative to typing them out, especially if the field names are dynamic, would be to write your own search command to do this task.

Re: Create multiple eval fields with wilcards?

sbsbb — Tue, 21 May 2013 13:51:43 GMT

I need this function too, hopefully it will come with next release of splunk

Re: Create multiple eval fields with wilcards?

dwaddle — Tue, 21 May 2013 15:23:06 GMT

sbsbb, if this is something you need make sure your file an enhancement request about it.