Splunk Search

Calculated fields in an eval statement

bcarlson
New Member

Good Morning! I am trying to build calculated fields that will create a wireless roamer cost report. The report is based on a search of CDR's (Call Detail Records) The search provides me with User,Carrier_Name, and Total_Megabytes_Used.

I am trying to use calculated fields to add in the roamer cost.

eval Roamer_Cost = case(Carrier_Name=Bob Wireless,Total_Megabytes *.055,Carrier_Name=Jill Wireless,Total_Megabytes * .10,Carrier-Name=Home Wireless,Total Megabytes *.0)

The report could then be charted to provide me with a report by user showing cost of roaming on each Carrier_Name.

Any ideas how I can make this work? Or suggestions of other ways to skin this cat?

thanks
bob

Tags (2)
0 Karma
1 Solution

asimagu
Builder

you need to use the case statement with the right syntax

eval Roamer_Cost=case(Carrier_Name=="Bob Wireles", Total_Megabytes_Used*0.055, ...and so on...)

then you need to pipe your search to this

chart sum(Roamer_Cost) over Carrier_Name by User

View solution in original post

0 Karma

asimagu
Builder

you need to use the case statement with the right syntax

eval Roamer_Cost=case(Carrier_Name=="Bob Wireles", Total_Megabytes_Used*0.055, ...and so on...)

then you need to pipe your search to this

chart sum(Roamer_Cost) over Carrier_Name by User
0 Karma

bcarlson
New Member

asimagu, Thank You for the assistance! Bob

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...