Splunk Search

How to add two field values into new field?

vinothkumark
Path Finder

I have a field A which has percentage values. Also, I have a field B which has percentage values in it. Both are different values. 

Now I want to create a new field which adds both the values. 

A              B

10%      30%

20%      50%

30%     70%

The query should fetch me the results like below:

C

40%

70%

100%

Labels (3)
Tags (1)
0 Karma
1 Solution

fredclown
Builder

This should work.

| makeresults
| eval A = "10%"
| eval B = "20%"
```The stuff above is just to get sone sample data```
| eval C = tonumber(replace(A,"\D","")) + tonumber(replace(B,"\D","")) . "%"

View solution in original post

vinothkumark
Path Finder

@fredclown 
Thanks for input. It works.  Can you help on the query if the values are in decimal?
A              B

10.5      20.3

C
30.8

0 Karma

fredclown
Builder

This should work.

| makeresults
| eval A = "10%"
| eval B = "20%"
```The stuff above is just to get sone sample data```
| eval C = tonumber(replace(A,"\D","")) + tonumber(replace(B,"\D","")) . "%"

fredclown
Builder

This should work with decimals and non-numeric characters.

| makeresults
| eval A = "10.5% sdfgdsfgjlk"
| eval B = "20.2% gdsfdf"
```The stuff above is just to get sone sample data```
| eval C = tonumber(replace(A,"[^0-9\.]+","")) + tonumber(replace(B,"[^0-9\.]+","")) . "%"

 

Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...