topic How to add two field values into new field? in Splunk Search

How to add two field values into new field?

vinothkumark — Thu, 19 Jan 2023 05:54:34 GMT

I have a field A which has percentage values. Also, I have a field B which has percentage values in it. Both are different values.

Now I want to create a new field which adds both the values.

A B

10% 30%

20% 50%

30% 70%

The query should fetch me the results like below:

C

40%

70%

100%

Re: How to add two field values into new field?

fredclown — Wed, 18 Jan 2023 20:46:31 GMT

This should work.

| makeresults | eval A = "10%" | eval B = "20%" ```The stuff above is just to get sone sample data``` | eval C = tonumber(replace(A,"\D","")) + tonumber(replace(B,"\D","")) . "%"

Re: How to add two field values into new field?

vinothkumark — Thu, 19 Jan 2023 06:32:57 GMT

@fredclown
Thanks for input. It works. Can you help on the query if the values are in decimal?
A B

10.5 20.3

C
30.8

Re: How to add two field values into new field?

fredclown — Fri, 20 Jan 2023 17:22:22 GMT

This should work with decimals and non-numeric characters.

| makeresults | eval A = "10.5% sdfgdsfgjlk" | eval B = "20.2% gdsfdf" ```The stuff above is just to get sone sample data``` | eval C = tonumber(replace(A,"[^0-9\.]+","")) + tonumber(replace(B,"[^0-9\.]+","")) . "%"