Splunk Search

Calculated fields in an eval statement

bcarlson
New Member

Good Morning! I am trying to build calculated fields that will create a wireless roamer cost report. The report is based on a search of CDR's (Call Detail Records) The search provides me with User,Carrier_Name, and Total_Megabytes_Used.

I am trying to use calculated fields to add in the roamer cost.

eval Roamer_Cost = case(Carrier_Name=Bob Wireless,Total_Megabytes *.055,Carrier_Name=Jill Wireless,Total_Megabytes * .10,Carrier-Name=Home Wireless,Total Megabytes *.0)

The report could then be charted to provide me with a report by user showing cost of roaming on each Carrier_Name.

Any ideas how I can make this work? Or suggestions of other ways to skin this cat?

thanks
bob

Tags (2)
0 Karma
1 Solution

asimagu
Builder

you need to use the case statement with the right syntax

eval Roamer_Cost=case(Carrier_Name=="Bob Wireles", Total_Megabytes_Used*0.055, ...and so on...)

then you need to pipe your search to this

chart sum(Roamer_Cost) over Carrier_Name by User

View solution in original post

0 Karma

asimagu
Builder

you need to use the case statement with the right syntax

eval Roamer_Cost=case(Carrier_Name=="Bob Wireles", Total_Megabytes_Used*0.055, ...and so on...)

then you need to pipe your search to this

chart sum(Roamer_Cost) over Carrier_Name by User
0 Karma

bcarlson
New Member

asimagu, Thank You for the assistance! Bob

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...