Getting Data In

How do I filter event by specifiing bytes>(1024*10), having simple calculation on the right side of the field?

melonman
Motivator

Hi,

I am trying to search:

sourcetype=access* bytes>1024*10

But this returns event bytes less than 1024, and the result looks wrong.
Is there anyway to add calculation on the right side of field?

Thank you,

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You can use the where search command:

sourcetype=access* | where bytes>1024*10

Or, you can create a macro in macros.conf:

[evaluate(1)]
args = x
definition = tostring($x$)
iseval = true

Once you have this macro defined and scoped for your app, you can do this:

sourcetype=access* bytes > `evaluate(1024*10)`

In some circumstances (which are rare, and probably not applicable in your case) in newer versions of Splunk, the latter may perform considerably faster. In most cases, though, it will be about the same.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

You can use the where search command:

sourcetype=access* | where bytes>1024*10

Or, you can create a macro in macros.conf:

[evaluate(1)]
args = x
definition = tostring($x$)
iseval = true

Once you have this macro defined and scoped for your app, you can do this:

sourcetype=access* bytes > `evaluate(1024*10)`

In some circumstances (which are rare, and probably not applicable in your case) in newer versions of Splunk, the latter may perform considerably faster. In most cases, though, it will be about the same.

chris
Motivator

Hi

Try this

sourcetype=access* | where bytes>1024*10

To verify your it is working you can try this search:

 sourcetype=access*|where bytes>10*1024 | table bytes | sort bytes
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...