Splunk Search
Highlighted

Eval a field twice based on index name

Path Finder

I have a field totalVolumeGB thats value is based on the eval below. I want to eval the same field, but with a filter based on the index field.

The index field is essentially index=*.

... | eval totalVolumeGB=10*(homePathmaxDataSizeMB+coldPathmaxDataSizeMB)/1024

I want to add this to the previous query, when my "index=summary_*"

... | eval totalVolumeGB=23*(homePathmaxDataSizeMB+coldPathmaxDataSizeMB)/1024

0 Karma
Highlighted

Re: Eval a field twice based on index name

SplunkTrust
SplunkTrust

try this

   ... | eval totalVolumeGB=if(like(index,"summary_%"),23*(homePath_maxDataSizeMB+coldPath_maxDataSizeMB)/1024,10*(homePath_maxDataSizeMB+coldPath_maxDataSizeMB)/1024) | ...

OR

... | eval totalVolumeGB =(homePath_maxDataSizeMB+coldPath_maxDataSizeMB)/1024| eval totalVolumeGB=if(like(index,"summary_%"),23*totalVolumeGB ,10*totalVolumeGB ) | ...

View solution in original post

Highlighted

Re: Eval a field twice based on index name

SplunkTrust
SplunkTrust

Thanks @aelliott for pointing it out. corrected now.

0 Karma
Highlighted

Re: Eval a field twice based on index name

Motivator

how about something like this:
... | eval num=if(like(index,"summary%"),23,10) | eval totalVolumeGB=num*(homePathmaxDataSizeMB+coldPath_maxDataSizeMB)/1024