I basically want to eval a result-field based on the formula contained in another field. The formula in the other field references fields containing the actual values. E.g. input table is like this (The "Niederdruck" field contains the actual formula for each equipment):
So, for the first equipment, 1005, I want to have myresult field value = (a002-3)/10 = (7-3)/10 = 0.4
For the 2nd row, equipment, 1006, I want to have myresult value = (a002-4)/10 = (9-4)/10 = 0.5
And the 3rd one, equipment 1007, the myresult should be = (a002-6)/10 = (15-6)/10 = 0.9
It should be something simple like:
eval myresult = *evaluate the function contained in* Niederdruck
Maybe I only need to use a right "escape character" around Niederdruck, but I am struggling.
Reason is: in reality, there are around 60 of them (and they already contain the values to be shown!), and the end-user can select which of them to display, along with the formula in a timechart later... I basically only want to add the column "myresult" to the existing "input table"...
You can execute the RegEx value of any field against the string value of another field like this: | eval WoodcockMagic = replace(fieldnameSourceString, fieldnameRegExString, fieldnameReplacementString). Almost nobody knows that you can pass in EITHER string literals OR field names to eval's replace function!!!!!
I suggest you configure an external lookup. This way, you pass all parameters including the formula to an script (you can choose the programming language) and the script will calculate and return the result to Splunk.