Splunk Search

Calculated fields in an eval statement

bcarlson
New Member

Good Morning! I am trying to build calculated fields that will create a wireless roamer cost report. The report is based on a search of CDR's (Call Detail Records) The search provides me with User,Carrier_Name, and Total_Megabytes_Used.

I am trying to use calculated fields to add in the roamer cost.

eval Roamer_Cost = case(Carrier_Name=Bob Wireless,Total_Megabytes *.055,Carrier_Name=Jill Wireless,Total_Megabytes * .10,Carrier-Name=Home Wireless,Total Megabytes *.0)

The report could then be charted to provide me with a report by user showing cost of roaming on each Carrier_Name.

Any ideas how I can make this work? Or suggestions of other ways to skin this cat?

thanks
bob

Tags (2)
0 Karma
1 Solution

asimagu
Builder

you need to use the case statement with the right syntax

eval Roamer_Cost=case(Carrier_Name=="Bob Wireles", Total_Megabytes_Used*0.055, ...and so on...)

then you need to pipe your search to this

chart sum(Roamer_Cost) over Carrier_Name by User

View solution in original post

0 Karma

asimagu
Builder

you need to use the case statement with the right syntax

eval Roamer_Cost=case(Carrier_Name=="Bob Wireles", Total_Megabytes_Used*0.055, ...and so on...)

then you need to pipe your search to this

chart sum(Roamer_Cost) over Carrier_Name by User
0 Karma

bcarlson
New Member

asimagu, Thank You for the assistance! Bob

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...