Splunk Search

Calculated fields in an eval statement

bcarlson
New Member

Good Morning! I am trying to build calculated fields that will create a wireless roamer cost report. The report is based on a search of CDR's (Call Detail Records) The search provides me with User,Carrier_Name, and Total_Megabytes_Used.

I am trying to use calculated fields to add in the roamer cost.

eval Roamer_Cost = case(Carrier_Name=Bob Wireless,Total_Megabytes *.055,Carrier_Name=Jill Wireless,Total_Megabytes * .10,Carrier-Name=Home Wireless,Total Megabytes *.0)

The report could then be charted to provide me with a report by user showing cost of roaming on each Carrier_Name.

Any ideas how I can make this work? Or suggestions of other ways to skin this cat?

thanks
bob

Tags (2)
0 Karma
1 Solution

asimagu
Builder

you need to use the case statement with the right syntax

eval Roamer_Cost=case(Carrier_Name=="Bob Wireles", Total_Megabytes_Used*0.055, ...and so on...)

then you need to pipe your search to this

chart sum(Roamer_Cost) over Carrier_Name by User

View solution in original post

0 Karma

asimagu
Builder

you need to use the case statement with the right syntax

eval Roamer_Cost=case(Carrier_Name=="Bob Wireles", Total_Megabytes_Used*0.055, ...and so on...)

then you need to pipe your search to this

chart sum(Roamer_Cost) over Carrier_Name by User
0 Karma

bcarlson
New Member

asimagu, Thank You for the assistance! Bob

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...