Splunk Search
Highlighted

How to create and declare a reuseable calculated eval expression that each of my data model's eval fields can access?

Path Finder

In my data model, I have a number of calculated fields that are derived from an Eval Expression. As the same expression is needed in multiple Data Model's, I'm starting to see some repeated logic. Is it possible for me to declare a function globally that each of my Data Model's expressions fields can access.

So instead of the following in my Expression:

if( 'some_node' = "YES" or 'some_other_node' = "YES", "true", "false")

I would have

if(myFunction(some_node,some_other_node)

Thanks.

0 Karma
Highlighted

Re: How to create and declare a reuseable calculated eval expression that each of my data model's eval fields can access?

Builder

You can create macros and use them in your expression -

docs.splunk.com/Documentation/Splunk/6.2.3/Search/Usesearchmacros

For e.g.

macro name : my_strptime(1)
definition : eval $field$=round(strptime($field$, "%m/%d/%Y:%H:%M:%S"), 0)

So any 'time' field that you pass to the macro by calling " | my_strptime(my_time_field)", will be processed in this format.

Highlighted

Re: How to create and declare a reuseable calculated eval expression that each of my data model's eval fields can access?

Path Finder

Can this macros be applied to the calculated fields in the data model (not in the actual query as this is created by the pivots) ?

0 Karma