Calculations During Log File Ingest

notnavi · ‎07-10-2014

Is it possible to execute a calculation during log file ingest based on two fields in the log file with the result of the calculation placed in a new field?

My Splunk admin states that is not possible, but seems too simple a function to be able to do.

richgalloway · ‎07-10-2014

Add EVAL statements to your props.conf file. See http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Propsconf

---
If this reply helps you, Karma would be appreciated.

martin_mueller · ‎07-10-2014

Do note though, calculated fields are not calculated during log file ingest / at index time but rather at search time.

At index time you're stuck with regular expressions, which do not have the power to do maths.

somesoni2 · ‎07-10-2014

Another link with steps to add eval (calculated fields) from UI and props.conf

http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/definecalcfields

Calculations During Log File Ingest

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

Calculations During Log File Ingest

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...