Hi All,Is this possible in splunk
i have data like below
field1 field2
1500m 20GB
2000m 21GB
45 500mb
1440m 250mb
12 15GB
in the field1, if any digit is not ending with "m" then should multiply by 1000.
in field2, if any digit is not ending with 'GB' then divided by 1024
for example, the result should be like this.
field1 field2
1500 m 20GB
2000 m 21GB
45000 m 0.48GB
1440 m 0.24GB
12000 m 15GB
Hi @kirrusk ,
See if the following does the trick (ignore the first 4 lines which I used to replicate your example):
| makeresults
| eval fields = split("1500m,20GB|2000m,21GB|45,500mb|1440m,250mb|12,15GB", "|")
| mvexpand fields
| rex field=fields "(?<field1>[^\,]+)\,(?<field2>.+?)$" | fields - _time, fields
| rex field=field1 "(?<field1_num>\d+)(?<field1_unit>\D*)$"
| rex field=field2 "(?<field2_num>\d+)(?<field2_unit>\D*)$"
| eval
field1_num = if(NOT match(field1_unit, "m$") OR isNull(field1_unit), field1_num*1000, field1_num),
field2_num = if(NOT match(field2_unit, "GB$") OR isNull(field2_unit), round(field2_num/1024,2), field2_num),
field1_unit = "m",
field2_unit = "GB"
| eval
field1 = field1_num.field1_unit,
field2 = field2_num.field2_unit
| table field1, field2
And the screenshot from my lab:
| makeresults
| eval _raw="field1,field2
1500m,20mb
2000m,1mb
45,500mb
1440m,2500mb
12,15GB"
| multikv forceheader=1
| fields - _* linecount
| rex field=field1 mode=sed "s/(?<d>\d+)$/\1km/g s/km/000m/g"
| rex field=field2 mode=sed "s/(?<d>^\d)mb/0\1mb/g s/(?<d>^\d\d)mb/0\1mb/g s/(?<d>\d{3})mb/.\1GB/g s/^\./0./g"
Hi @kirrusk ,
See if the following does the trick (ignore the first 4 lines which I used to replicate your example):
| makeresults
| eval fields = split("1500m,20GB|2000m,21GB|45,500mb|1440m,250mb|12,15GB", "|")
| mvexpand fields
| rex field=fields "(?<field1>[^\,]+)\,(?<field2>.+?)$" | fields - _time, fields
| rex field=field1 "(?<field1_num>\d+)(?<field1_unit>\D*)$"
| rex field=field2 "(?<field2_num>\d+)(?<field2_unit>\D*)$"
| eval
field1_num = if(NOT match(field1_unit, "m$") OR isNull(field1_unit), field1_num*1000, field1_num),
field2_num = if(NOT match(field2_unit, "GB$") OR isNull(field2_unit), round(field2_num/1024,2), field2_num),
field1_unit = "m",
field2_unit = "GB"
| eval
field1 = field1_num.field1_unit,
field2 = field2_num.field2_unit
| table field1, field2
And the screenshot from my lab: