Splunk Search

How to add two field values into new field?

vinothkumark
Path Finder

I have a field A which has percentage values. Also, I have a field B which has percentage values in it. Both are different values. 

Now I want to create a new field which adds both the values. 

A              B

10%      30%

20%      50%

30%     70%

The query should fetch me the results like below:

C

40%

70%

100%

Labels (3)
Tags (1)
0 Karma
1 Solution

fredclown
Contributor

This should work.

| makeresults
| eval A = "10%"
| eval B = "20%"
```The stuff above is just to get sone sample data```
| eval C = tonumber(replace(A,"\D","")) + tonumber(replace(B,"\D","")) . "%"

View solution in original post

vinothkumark
Path Finder

@fredclown 
Thanks for input. It works.  Can you help on the query if the values are in decimal?
A              B

10.5      20.3

C
30.8

0 Karma

fredclown
Contributor

This should work.

| makeresults
| eval A = "10%"
| eval B = "20%"
```The stuff above is just to get sone sample data```
| eval C = tonumber(replace(A,"\D","")) + tonumber(replace(B,"\D","")) . "%"

fredclown
Contributor

This should work with decimals and non-numeric characters.

| makeresults
| eval A = "10.5% sdfgdsfgjlk"
| eval B = "20.2% gdsfdf"
```The stuff above is just to get sone sample data```
| eval C = tonumber(replace(A,"[^0-9\.]+","")) + tonumber(replace(B,"[^0-9\.]+","")) . "%"

 

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...