Splunk Search

How Do I Filter A Query By A Dynamic Created Eval Field?

vtsguerrero
Contributor

For example, in each log, I have start_date and end_date, they both together become eval length = ( end_date - start_date ).
So I need my query to be like:

index=test lenght=??/??/???? DD/MM/YYYY | timechart count by logs

Is there a way I can create this dinamic field to be a fixed eval command for splunk? How do I do this?

Thanks in advance!

Tags (1)
1 Solution

wpreston
Motivator

There are a couple of ways to handle this. If you want this length field to be created without having to perform an eval statement in your search, you can add the eval statement to your props.conf file. Once it's in there, Splunk will automatically eval that field at search time when it extracts the rest of your fields. Add a statement like this to the appropriate props.conf stanza(s):

EVAL-length = end_date - start_date

Or, if you only want to filter on the length field after you've eval'd it in a search, just add a | search statement onto the end of your search. This will filter your search results down by whatever your search string is:

index=test rest of search terms | eval length=end_date-start_date | search length > foo

View solution in original post

wpreston
Motivator

There are a couple of ways to handle this. If you want this length field to be created without having to perform an eval statement in your search, you can add the eval statement to your props.conf file. Once it's in there, Splunk will automatically eval that field at search time when it extracts the rest of your fields. Add a statement like this to the appropriate props.conf stanza(s):

EVAL-length = end_date - start_date

Or, if you only want to filter on the length field after you've eval'd it in a search, just add a | search statement onto the end of your search. This will filter your search results down by whatever your search string is:

index=test rest of search terms | eval length=end_date-start_date | search length > foo

vtsguerrero
Contributor

There might be a dynamic eval for a string as well, for example eval channel = (log_a + log_b + "channel")

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...