Splunk Search

Convert Memory Count only if Value > 1000

matt4321
Explorer

I have data in the following format.

Value should be in Gb
MemoryCount=64

I have a few values that were improperly entered as Mb like below
MemoryCount=64000

I would like to see if it is possible to do an eval to detect any value over 1024 and divide it by 1024 to convert it to Gb.
I have tried the below and it did not work.
| eval MemoryCount=if(MemoryCount>1000, MemoryCount/1024)

Is there any way of accomplishing this?

matt4321

Tags (1)
0 Karma
1 Solution

maciep
Champion

I think you just need the else param for your if function

| eval MemoryCount=if(MemoryCount>1000, MemoryCount/1024, MemoryCount)

View solution in original post

0 Karma

maciep
Champion

I think you just need the else param for your if function

| eval MemoryCount=if(MemoryCount>1000, MemoryCount/1024, MemoryCount)
0 Karma

matt4321
Explorer

Ahh ok I thought I was missing something. This worked perfectly!!

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...