Splunk Search

Eval statement based of 1 field using If

codedtech
Path Finder

I have a bunch of storage clusters that we monitor,  60% of the envrioment uses normal GB, the other 40% uses GiB.  I need to show all of the storage arrays in 1 report and normalize the storage to GB, and the only field that is different between the storage besides the array name is "storage vendor" .  I need to create an If statement if vendor is like "X"  run these evals 
|eval _GB_TiB = (((Capacity_GB)*1.1)/1024)*0.909495
| eval "Prov(TiB)" = (((prov_GB)*1.1)/1024)*0.909495
| eval "Written(TiB)" = ((((writtedGB)*1.1)/1024)*0.909495)/2

 

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
How should Splunk distinguish those that use GB from those that use GiB?
---
If this reply helps you, Karma would be appreciated.
0 Karma

codedtech
Path Finder

I like to use an If or case statement ideally based of the vendor or storage array name.  

 

something along the lines like this

query|eval if(vendor="vendor 1(then  eval Capacity(TiB) = (((Capacity_GB)*1.1)/1024)*0.909495
| eval "provisioned (TiB)" = (((provisionedGB)*1.1)/1024)*0.909495
| eval "Written(TiB)" = ((((usedGB)*1.1)/1024)*0.909495)/2

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will help

... | eval Capacity = if(vendor="foo" OR vendor="bar", exact((GB*1.1)/1024)*0.909495), GB)
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...