Splunk Search

## How to implement math calculations?

Path Finder

Hey, Fellow Splunkers

I'm curious to know if it's possible to preform math calculations on a set of "refined" data; for example:

Let's say I extracted a field that presents the values of a gigabit into megabit? meaning I have 5 gig it would then be converted into 5120.
so ideally I would like to take an entire field of data and multiple it by 1024? and have that information be presented when I call the field into a table?

intial
5gb
4gb
3gb

output
5120mb
4096mb
3072mb

Tags (1)
1 Solution
SplunkTrust

``````  | eval output=initial*1024
``````

Or in this case you'd have to get the number first with Rex

``````  | rex field=initial "(?<gb>\d+)" | eval output=gb*1024
``````
SplunkTrust

``````  | eval output=initial*1024
``````

Or in this case you'd have to get the number first with Rex

``````  | rex field=initial "(?<gb>\d+)" | eval output=gb*1024
``````
Path Finder

hey, thx

the answer was correct, however it was off by a bit had to enter another \d +\d for other decimal values.

thank you, asarran

SplunkTrust

Hi asarran,

take a look at the docs about the `convert` command http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Convert and its option `memk()`.
But to answer your question, math calculation can be made with the `eval` command http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval using the Arithmetic operators.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

#### Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

#### Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

#### Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...