Splunk Search

Eval function for Variable Calculations

New Member

I have a logic which I want to implement in Splunk, but I'm getting confused with the syntax.Let me explain what I am trying to achieve:

I have three variables: Multiplier, NAS, Tolls.

Now for weightage I have implemented an idea where the Multipliers will work according to the year it was paid. So, for example:
2020=1, 2019=0.9, 2018=0.8 ----2010=0.

NAS, it will work as an variable which user will have to input but it has to be between 1 to 5.

Tolls, this will be like say X no. of tolls occur in a particular area so, X=x1+x2+x3
X=(No. of tolls*Multiplier of toll occur)

For example, 6 tolls occur in 2018, 3 in 2019 and 6 in 2020. The equation will look like this:
X= {(6*0.8)+(3*0.9)+(6*1)}

Now I want to evaluate the Total Weight, so the formula is=1- NAS(manual input)*X/100, And display the answer.

0 Karma


I see your logic.

aggregate by eventstats count(tolls) by year.
so you can calculate with eval

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!