Splunk Search

Can we use the eval command to calculate fields across different sourcetypes? What is the best approach?

ewm87
New Member

Hello,

I'm trying to do simple calculations with the eval command but the fields I need to calculate are spread across a number sourcetypes. The query would ultimately have a variable for user ID and would calculate data specific to the user located across multiple sourcetypes

Would I want to use a combination of transaction/subsearches? I've tried both and a couple other approaches but I'm not sure if my issue is conceptual or with my syntax. Any suggestions?

Thanks for any help,

0 Karma

mship
Path Finder

Use the coalesce() function. This will allow you to group events from multiple sourcetypes.

sdaniels
Splunk Employee
Splunk Employee

I don't think it's a conceptual issue, that should be fine. As long as the first part of your search when you narrow it down (sourcetype=* user=x ) that the user exists in both source events. Otherwise, the field you try to calculate won't return in the result set and when eval is applied you'll get nothing.

0 Karma

ewm87
New Member

Well, I can give an example but in all honesty I'm not sure if my issue is conceptual?

var1 would be a field in source1
var2 would be a field in source2

(sourcetype="source1") OR (sourcetype="source2")| user_id="ID" | eval percentage=(var1/var2) | top percentage

OR

sourcetype="*" user_id="ID" | eval percentage=(var1/var2) | top percentage

Not sure if this clarifies...

0 Karma

sdaniels
Splunk Employee
Splunk Employee

It would probably help to see the examples of what you have tried.

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...