topic Re: Found useful trick to have field values as new fields with {field} in Splunk Search

Found useful trick to have field values as new fields with {field}

splunkreal — Wed, 07 Dec 2022 16:07:50 GMT

Hello,

we found useful trick to have field values as new fields, for example :

| eval {status}=status | timechart count count(failed) as FAILED | eval failed_percent=FAILED/count*100

How do you call this? Is is documented?

Thanks 🙂

bowesmana — Thu, 08 Dec 2022 02:24:00 GMT

There is a tiny sentence associated with that feature in the eval documentation page

I believe I have seen this spoken about as 'dummy encoding', but that is not in those pages.

It is a VERY useful feature, as it supports that syntax within any other text, so you can do stuff like

| eval a=random(), b=random(), my_random1_{a}_and_random2_{b}_vars="done"