Splunk Search

Create multiple eval fields with wilcards?

jweinstein
Engager

I'm attempting to calculate the deltas between a field and it's historical value. I use a subquery w/ appendcols to return the historical data and it is nicely in the form:

Group, field1, field2, field1_historical, field2_historical

I can create the deltas with:

 | eval field1_delta = field1 - field1_historical
 | eval field2_delta = field2 - field2_historical

This works but I'd like to generalize it:

| eval *_delta = * - *_historical 

but I get the error:

Error in 'eval' command: The expression is malformed. An unexpected character is reached at '* - *_historical'.

Any tips?

Tags (1)

gkanapathy
Splunk Employee
Splunk Employee

Sorry, no. You'll just have to type it out. You can try using a macro to shorten your typing, but you're still going to have to specify the field base names.

dwaddle
SplunkTrust
SplunkTrust

sbsbb, if this is something you need make sure your file an enhancement request about it.

0 Karma

sbsbb
Builder

I need this function too, hopefully it will come with next release of splunk

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

An alternative to typing them out, especially if the field names are dynamic, would be to write your own search command to do this task.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...