Splunk Search

How to add two field values into new field?

vinothkumark
Path Finder

I have a field A which has percentage values. Also, I have a field B which has percentage values in it. Both are different values. 

Now I want to create a new field which adds both the values. 

A              B

10%      30%

20%      50%

30%     70%

The query should fetch me the results like below:

C

40%

70%

100%

Labels (3)
Tags (1)
0 Karma
1 Solution

fredclown
Builder

This should work.

| makeresults
| eval A = "10%"
| eval B = "20%"
```The stuff above is just to get sone sample data```
| eval C = tonumber(replace(A,"\D","")) + tonumber(replace(B,"\D","")) . "%"

View solution in original post

vinothkumark
Path Finder

@fredclown 
Thanks for input. It works.  Can you help on the query if the values are in decimal?
A              B

10.5      20.3

C
30.8

0 Karma

fredclown
Builder

This should work.

| makeresults
| eval A = "10%"
| eval B = "20%"
```The stuff above is just to get sone sample data```
| eval C = tonumber(replace(A,"\D","")) + tonumber(replace(B,"\D","")) . "%"

fredclown
Builder

This should work with decimals and non-numeric characters.

| makeresults
| eval A = "10.5% sdfgdsfgjlk"
| eval B = "20.2% gdsfdf"
```The stuff above is just to get sone sample data```
| eval C = tonumber(replace(A,"[^0-9\.]+","")) + tonumber(replace(B,"[^0-9\.]+","")) . "%"

 

Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...