Splunk Search

How to exclude a field in foreach?

HeinzWaescher
Motivator

Hi,

is it possible to exclude one specific field in the foreach command?
Currently it looks like this, but I want to exclude the "size" field here:

| foreach * [eval <<FIELD>>=round('<<FIELD>>'/size*100, 2)]

Cheers
Heinz

0 Karma
1 Solution

javiergn
Super Champion

Try this:

| foreach * [eval <<FIELD>>=if("<<FIELD>>" == "size", size, round('<<FIELD>>'/size*100, 2))]

View solution in original post

javiergn
Super Champion

Try this:

| foreach * [eval <<FIELD>>=if("<<FIELD>>" == "size", size, round('<<FIELD>>'/size*100, 2))]

HeinzWaescher
Motivator

Awesome, thanks a lot!

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...