topic Re: Calculated fields in an eval statement in Splunk Search

Calculated fields in an eval statement

bcarlson — Mon, 28 Sep 2020 14:18:39 GMT

Good Morning! I am trying to build calculated fields that will create a wireless roamer cost report. The report is based on a search of CDR's (Call Detail Records) The search provides me with User,Carrier_Name, and Total_Megabytes_Used.

I am trying to use calculated fields to add in the roamer cost.

eval Roamer_Cost = case(Carrier_Name=Bob Wireless,Total_Megabytes *.055,Carrier_Name=Jill Wireless,Total_Megabytes * .10,Carrier-Name=Home Wireless,Total Megabytes *.0)

The report could then be charted to provide me with a report by user showing cost of roaming on each Carrier_Name.

Any ideas how I can make this work? Or suggestions of other ways to skin this cat?

thanks
bob

Re: Calculated fields in an eval statement

asimagu — Wed, 10 Jul 2013 23:41:16 GMT

you need to use the case statement with the right syntax

eval Roamer_Cost=case(Carrier_Name=="Bob Wireles", Total_Megabytes_Used*0.055, ...and so on...)

then you need to pipe your search to this

chart sum(Roamer_Cost) over Carrier_Name by User

Re: Calculated fields in an eval statement

bcarlson — Thu, 11 Jul 2013 15:04:53 GMT

asimagu, Thank You for the assistance! Bob