Splunk Search

How To Generate A Fixed Eval Field?

Contributor

I have a field in search time :

| eval Volume = (QuantityA + QuantityB)

How can I let this automatic, so I can just use Volume instead of creating this eval field for each query.

Tags (2)
0 Karma
1 Solution

Revered Legend

You can define calculated fields as mentioned in the link below. Whatever you put in EVAL can be used here.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/definecalcfields

View solution in original post

Revered Legend

You can define calculated fields as mentioned in the link below. Whatever you put in EVAL can be used here.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/definecalcfields

View solution in original post

Builder

You should be able to do this in your conf files, transforms.conf and fields.conf and props.conf

Take a look here, looks like somebody's already answered that question;
http://answers.splunk.com/answers/39405/adding-static-field-value-using-props-transforms-based-on-so...

0 Karma