Splunk Search

How to add two field values into new field?

vinothkumark
Path Finder

I have a field A which has percentage values. Also, I have a field B which has percentage values in it. Both are different values. 

Now I want to create a new field which adds both the values. 

A              B

10%      30%

20%      50%

30%     70%

The query should fetch me the results like below:

C

40%

70%

100%

Labels (3)
Tags (1)
0 Karma
1 Solution

fredclown
Builder

This should work.

| makeresults
| eval A = "10%"
| eval B = "20%"
```The stuff above is just to get sone sample data```
| eval C = tonumber(replace(A,"\D","")) + tonumber(replace(B,"\D","")) . "%"

View solution in original post

vinothkumark
Path Finder

@fredclown 
Thanks for input. It works.  Can you help on the query if the values are in decimal?
A              B

10.5      20.3

C
30.8

0 Karma

fredclown
Builder

This should work.

| makeresults
| eval A = "10%"
| eval B = "20%"
```The stuff above is just to get sone sample data```
| eval C = tonumber(replace(A,"\D","")) + tonumber(replace(B,"\D","")) . "%"

fredclown
Builder

This should work with decimals and non-numeric characters.

| makeresults
| eval A = "10.5% sdfgdsfgjlk"
| eval B = "20.2% gdsfdf"
```The stuff above is just to get sone sample data```
| eval C = tonumber(replace(A,"[^0-9\.]+","")) + tonumber(replace(B,"[^0-9\.]+","")) . "%"

 

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...