topic Re: using EVAL in Splunk Search

using EVAL

mikefoti — Thu, 12 Apr 2012 13:26:08 GMT

I have a form that prompts user for a 4 digit number representing a location. I want to insert that location number into a formula that calculates the location's IP address. I then want to use that IP as the basis for a search.

My formula with a location number of 0191 looks like this:

10.(INT(0191/256+170)).(MOD(0191,256)).48)

The resulting IP address is 10.170.191.48

I then hope to use the IP is the following search:

index="winradius" nps_nasIP=10.170.191.48

So I think I would use EVAL as follows:

index="winradius" (eval nps_nasIP=10.(INT(0191/256+170)).(MOD(0191,256)).48)

But this doesn't work.
No error message... just no results are returned.
Not sure how to fix or even troubleshoot this.

Re: using EVAL

ziegfried — Thu, 12 Apr 2012 13:42:10 GMT

You could do this using a subsearch:

index="winradius" [ | stats count | eval nps_nasIP="10." . tostring(floor(tonumber("0191")/256+170)) . "." . tostring(tonumber("0191")%256) . ".48" | return nps_nasIP ]

Re: using EVAL

mikefoti — Thu, 12 Apr 2012 13:51:37 GMT

A couple of things....
1 - thanks for the very quick reply!
2 - unfortunately it doesn't work
3 - what does this string do . "." .
4 - in my formula INT and MOD are mathematical functions so I would not expect replacing the function names with "tonumber" to return the expected result

INT means "round the result to nearest whole number"
MOD(191/256) means "tell me the remainder if 191 is devided by 265"

Re: using EVAL

ziegfried — Thu, 12 Apr 2012 13:57:37 GMT

it should work, at least on 4.3. The subsearch creates an additional condition for the outer search nps_nasIP="10.170.191.48".

The dot characeter . is used for string concatenation.

There's no INT and MOD function for Splunk's eval command so I changed them to INT ==> floor(tonumber(X)) and MOD ==> X%Y

Here's a list of functions you can use with the eval command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

Re: using EVAL

mikefoti — Thu, 12 Apr 2012 14:20:39 GMT

Thanks.
Can you tell me if, rather they trying to evaluate the formula within the search string, I can insert some code into the form... so that when the user enters 0191, the form calls a script to apply the formula and then inserts he result to the search?

Re: using EVAL

ziegfried — Thu, 12 Apr 2012 14:23:40 GMT

Yes, it's possible. You should take a look at the SideviewUtils app and try to do that using customBahavior on form elements.

http://splunk-base.splunk.com/apps/36405/sideview-utils

Re: using EVAL

landen99 — Fri, 21 Nov 2014 17:59:14 GMT

or just round(x)