Splunk Search

Convert Memory Count only if Value > 1000

matt4321
Explorer

I have data in the following format.

Value should be in Gb
MemoryCount=64

I have a few values that were improperly entered as Mb like below
MemoryCount=64000

I would like to see if it is possible to do an eval to detect any value over 1024 and divide it by 1024 to convert it to Gb.
I have tried the below and it did not work.
| eval MemoryCount=if(MemoryCount>1000, MemoryCount/1024)

Is there any way of accomplishing this?

matt4321

Tags (1)
0 Karma
1 Solution

maciep
Champion

I think you just need the else param for your if function

| eval MemoryCount=if(MemoryCount>1000, MemoryCount/1024, MemoryCount)

View solution in original post

0 Karma

maciep
Champion

I think you just need the else param for your if function

| eval MemoryCount=if(MemoryCount>1000, MemoryCount/1024, MemoryCount)
0 Karma

matt4321
Explorer

Ahh ok I thought I was missing something. This worked perfectly!!

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...