Splunk Search

How to do a common eval operation with dynamic field values?

joydeep741
Path Finder

I have a splunk query

index=abc sourcetype=xyz | timechart by field1 

This gives me data like

_time column1 cloumn2 column3 ..... coulumnN

Now , I want to do a common eval operation on all of these columns. But I do not want to HARD CODE the column names (as I do not know before hand the values of field1)

Right now I am doing like this
index=abc sourcetype=xyz | timechart by field1 | eval column1= column1 + 100 | eval column2= column2 + 100 | eval coulmn3 = column3 +100........ and so on.

That way I am having multiple eval statements, even though I am performing the same operation eval column= column + 100

Can someone guide me a better approach of doing this?

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

You got forearch command for it. Try like this

index=abc sourcetype=xyz | timechart by field1
| foreach * [| eval "<<FIELD>>"='<<FIELD>>'+100]

Using * in foreach will process all fields whose name doesn't start with underscore (which are internal fields). The construct <<FIELD>> (used with double quotes in LHS of equal sign and used with single quotes on RHS, just in case column names may contain special characters) should be use as is. See this for more information:
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Foreach

View solution in original post

woodcock
Esteemed Legend

You can iterate over fields with the foreach command:

... | foreach col* [ eval <<FIELD>> = <<FIELD>> + 100]
0 Karma

somesoni2
Revered Legend

You got forearch command for it. Try like this

index=abc sourcetype=xyz | timechart by field1
| foreach * [| eval "<<FIELD>>"='<<FIELD>>'+100]

Using * in foreach will process all fields whose name doesn't start with underscore (which are internal fields). The construct <<FIELD>> (used with double quotes in LHS of equal sign and used with single quotes on RHS, just in case column names may contain special characters) should be use as is. See this for more information:
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Foreach

Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...