Archive
Highlighted

Converting from KB to GB

Contributor

Hi All,

i have search that brings data from C and D Drives and results are in KB so i want to convert those fields to GB.

index="main" host="hc1xrds01" Name="C:" OR Name="D:" FreeSpace |eval FreeSpace = round((FreeSpace/1024/1024/1024), 2)

alt text

I still have fields after the conversion in kbs.and even after eval i get another "FreeSpace" field with GB the other FreeSpace taht is highligted is still in KB.how do i change all that to GB?not just the FreeSpace,size and Raw as well which i believe is the top value.

do i have to change the way i get the data?

Thanks Alot

Tags (1)
0 Karma
Highlighted

Re: Converting from KB to GB

Influencer

Your eval statement creates a new search time field. The raw data is not altered. What you see on the top is your actual raw data. To avoid confusion, name your new field different

|eval FreeSpace_GB = round((FreeSpace/1024/1024/1024)
0 Karma
Highlighted

Re: Converting from KB to GB

SplunkTrust
SplunkTrust

Hey
What you have written is correct
Evaluation functions does not change your raw data.It just creates a new field which you can use it further for analysis.

index="main" host="hc1xrds01" Name="C:" OR Name="D:" FreeSpace |eval FreeSpace_in_GB = round((FreeSpace/1024/1024/1024), 2)

FreeSpaceinGB is the new field created by this search. Use this field for your analysis and not the one which you see FreeSpace.

Let me know if it helps you!

View solution in original post

0 Karma
Highlighted

Re: Converting from KB to GB

Contributor

That worked thanks.so i wanto make a dashboard from these results but i am having hard time .when i select visualization the data it shows is cropped and not showing all the drives.can you help me with that?if i need to create another thread for it,i can do it.Thanks for all the help

index="main" host="hc1aptr3sv" Name="C:" OR Name="D:" FreeSpace | eval FreeSpaceinGB = round((FreeSpace/1024/1024/1024), 2)|eval SizeinGB = round((Size/1024/1024/1024),2)|table host,Name,SizeinGB,FreeSpaceinGB| dedup Namealt text

0 Karma