How Do I Filter A Query By A Dynamic Created Eval Field?

[vtsguerrero]

For example, in each log, I have start_date and end_date, they both together become eval length = ( end_date - start_date ).
So I need my query to be like:

index=test lenght=??/??/???? DD/MM/YYYY | timechart count by logs

Is there a way I can create this dinamic field to be a fixed eval command for splunk? How do I do this?

Thanks in advance!

[wpreston · Accepted solution]

There are a couple of ways to handle this. If you want this length field to be created without having to perform an eval statement in your search, you can add the eval statement to your props.conf file. Once it's in there, Splunk will automatically eval that field at search time when it extracts the rest of your fields. Add a statement like this to the appropriate props.conf stanza(s):

EVAL-length = end_date - start_date

Or, if you only want to filter on the length field after you've eval'd it in a search, just add a | search statement onto the end of your search. This will filter your search results down by whatever your search string is:

index=test rest of search terms | eval length=end_date-start_date | search length > foo

[vtsguerrero]

There might be a dynamic eval for a string as well, for example eval channel = (log_a + log_b + "channel")