Splunk Search

How to use eval to do simple conversion?

Michael
Contributor

Wow, I can't believe this is kicking my butt -- think I need an idiot check... (yes, I know... 😉

I'm trying to do a simple conversion: sizeK=(fileinfo.size/1024) but it's failing. I've done these hundreds of times before, and have it documented in my notes from years ago. Oh, and triple checked it here against multiple examples.

The whole line is simply:

index=suricata event_type=fileinfo| eval sizeK=(fileinfo.size/1024)

It's not creating "sizeK".

When I change to:

| eval sizeK=round(fileinfo.size/1024)

or

| eval sizeK=round(fileinfo.size/1024,2)

I get: "Error in 'eval' command: The arguments to the 'round' function are invalid. "

Even tried:

| eval sizeK=fileinfo.size/1024

Still no workie. Suggestions?

Tags (2)
0 Karma
1 Solution

Vijeta
Influencer

@Michael Try renaming fileinfo.size.

index=suricata event_type=fileinfo| rename fileinfo.size as size |eval sizeK=(size/1024)

View solution in original post

0 Karma

somesoni2
Revered Legend

Your field name contains special character (dot, even hyphen and spaces will cause this) so when referencing it in expression parts (RHS of eval OR in where clause), you need to include it in single quotes, like this:

index=suricata event_type=fileinfo| eval sizeK=('fileinfo.size'/1024)

Without including it in single quotes, the dot is treated as concatenation operator and it's looking for two fields fileinfo and size to concatenate values, and which probably are not available.

0 Karma

Vijeta
Influencer

@Michael Try renaming fileinfo.size.

index=suricata event_type=fileinfo| rename fileinfo.size as size |eval sizeK=(size/1024)

View solution in original post

0 Karma

Michael
Contributor

OMG, that fixed it. That was making me nuts!

That's just silly that it can't handle that fieldname (I even tried "fileinfo.size" and 'fileinfo.size').

Thanks!

0 Karma

Vijeta
Influencer

@Michael If it has worked for you, please do accept the answer. Thanks!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!