Splunk Search

How to add two field values into new field?

vinothkumark
Path Finder

I have a field A which has percentage values. Also, I have a field B which has percentage values in it. Both are different values. 

Now I want to create a new field which adds both the values. 

A              B

10%      30%

20%      50%

30%     70%

The query should fetch me the results like below:

C

40%

70%

100%

Labels (3)
Tags (1)
0 Karma
1 Solution

fredclown
Builder

This should work.

| makeresults
| eval A = "10%"
| eval B = "20%"
```The stuff above is just to get sone sample data```
| eval C = tonumber(replace(A,"\D","")) + tonumber(replace(B,"\D","")) . "%"

View solution in original post

vinothkumark
Path Finder

@fredclown 
Thanks for input. It works.  Can you help on the query if the values are in decimal?
A              B

10.5      20.3

C
30.8

0 Karma

fredclown
Builder

This should work.

| makeresults
| eval A = "10%"
| eval B = "20%"
```The stuff above is just to get sone sample data```
| eval C = tonumber(replace(A,"\D","")) + tonumber(replace(B,"\D","")) . "%"

fredclown
Builder

This should work with decimals and non-numeric characters.

| makeresults
| eval A = "10.5% sdfgdsfgjlk"
| eval B = "20.2% gdsfdf"
```The stuff above is just to get sone sample data```
| eval C = tonumber(replace(A,"[^0-9\.]+","")) + tonumber(replace(B,"[^0-9\.]+","")) . "%"

 

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...