Splunk Search

Convert Memory Count only if Value > 1000

matt4321
Explorer

I have data in the following format.

Value should be in Gb
MemoryCount=64

I have a few values that were improperly entered as Mb like below
MemoryCount=64000

I would like to see if it is possible to do an eval to detect any value over 1024 and divide it by 1024 to convert it to Gb.
I have tried the below and it did not work.
| eval MemoryCount=if(MemoryCount>1000, MemoryCount/1024)

Is there any way of accomplishing this?

matt4321

Tags (1)
0 Karma
1 Solution

maciep
Champion

I think you just need the else param for your if function

| eval MemoryCount=if(MemoryCount>1000, MemoryCount/1024, MemoryCount)

View solution in original post

0 Karma

maciep
Champion

I think you just need the else param for your if function

| eval MemoryCount=if(MemoryCount>1000, MemoryCount/1024, MemoryCount)
0 Karma

matt4321
Explorer

Ahh ok I thought I was missing something. This worked perfectly!!

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...