Splunk Search

How to exclude a field in foreach?

Motivator

Hi,

is it possible to exclude one specific field in the foreach command?
Currently it looks like this, but I want to exclude the "size" field here:

| foreach * [eval <<FIELD>>=round('<<FIELD>>'/size*100, 2)]

Cheers
Heinz

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this:

| foreach * [eval <<FIELD>>=if("<<FIELD>>" == "size", size, round('<<FIELD>>'/size*100, 2))]

View solution in original post

SplunkTrust
SplunkTrust

Try this:

| foreach * [eval <<FIELD>>=if("<<FIELD>>" == "size", size, round('<<FIELD>>'/size*100, 2))]

View solution in original post

Motivator

Awesome, thanks a lot!

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!