Splunk Search

How to do a common eval operation with dynamic field values?

joydeep741
Path Finder

I have a splunk query

index=abc sourcetype=xyz | timechart by field1 

This gives me data like

_time column1 cloumn2 column3 ..... coulumnN

Now , I want to do a common eval operation on all of these columns. But I do not want to HARD CODE the column names (as I do not know before hand the values of field1)

Right now I am doing like this
index=abc sourcetype=xyz | timechart by field1 | eval column1= column1 + 100 | eval column2= column2 + 100 | eval coulmn3 = column3 +100........ and so on.

That way I am having multiple eval statements, even though I am performing the same operation eval column= column + 100

Can someone guide me a better approach of doing this?

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

You got forearch command for it. Try like this

index=abc sourcetype=xyz | timechart by field1
| foreach * [| eval "<<FIELD>>"='<<FIELD>>'+100]

Using * in foreach will process all fields whose name doesn't start with underscore (which are internal fields). The construct <<FIELD>> (used with double quotes in LHS of equal sign and used with single quotes on RHS, just in case column names may contain special characters) should be use as is. See this for more information:
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Foreach

View solution in original post

woodcock
Esteemed Legend

You can iterate over fields with the foreach command:

... | foreach col* [ eval <<FIELD>> = <<FIELD>> + 100]
0 Karma

somesoni2
Revered Legend

You got forearch command for it. Try like this

index=abc sourcetype=xyz | timechart by field1
| foreach * [| eval "<<FIELD>>"='<<FIELD>>'+100]

Using * in foreach will process all fields whose name doesn't start with underscore (which are internal fields). The construct <<FIELD>> (used with double quotes in LHS of equal sign and used with single quotes on RHS, just in case column names may contain special characters) should be use as is. See this for more information:
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Foreach

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...