Splunk Search

How to implement math calculations?

asarran
Path Finder

Hey, Fellow Splunkers

I'm curious to know if it's possible to preform math calculations on a set of "refined" data; for example:

Let's say I extracted a field that presents the values of a gigabit into megabit? meaning I have 5 gig it would then be converted into 5120.
so ideally I would like to take an entire field of data and multiple it by 1024? and have that information be presented when I call the field into a table?

intial
5gb
4gb
3gb

output
5120mb
4096mb
3072mb

Tags (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Eval is your friend...

  | eval output=initial*1024

Or in this case you'd have to get the number first with Rex

  | rex field=initial "(?<gb>\d+)" | eval output=gb*1024

View solution in original post

jkat54
SplunkTrust
SplunkTrust

Eval is your friend...

  | eval output=initial*1024

Or in this case you'd have to get the number first with Rex

  | rex field=initial "(?<gb>\d+)" | eval output=gb*1024

asarran
Path Finder

hey, thx

the answer was correct, however it was off by a bit had to enter another \d +\d for other decimal values.

I greatly appreciate your response,

thank you, asarran

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi asarran,

take a look at the docs about the convert command http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Convert and its option memk().
But to answer your question, math calculation can be made with the eval command http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval using the Arithmetic operators.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...