Splunk Search

How to use eval to do simple conversion?

Michael
Contributor

Wow, I can't believe this is kicking my butt -- think I need an idiot check... (yes, I know... :winking_face:

I'm trying to do a simple conversion: sizeK=(fileinfo.size/1024) but it's failing. I've done these hundreds of times before, and have it documented in my notes from years ago. Oh, and triple checked it here against multiple examples.

The whole line is simply:

index=suricata event_type=fileinfo| eval sizeK=(fileinfo.size/1024)

It's not creating "sizeK".

When I change to:

| eval sizeK=round(fileinfo.size/1024)

or

| eval sizeK=round(fileinfo.size/1024,2)

I get: "Error in 'eval' command: The arguments to the 'round' function are invalid. "

Even tried:

| eval sizeK=fileinfo.size/1024

Still no workie. Suggestions?

Tags (2)
0 Karma
1 Solution

Vijeta
Influencer

@Michael Try renaming fileinfo.size.

index=suricata event_type=fileinfo| rename fileinfo.size as size |eval sizeK=(size/1024)

View solution in original post

0 Karma

somesoni2
Revered Legend

Your field name contains special character (dot, even hyphen and spaces will cause this) so when referencing it in expression parts (RHS of eval OR in where clause), you need to include it in single quotes, like this:

index=suricata event_type=fileinfo| eval sizeK=('fileinfo.size'/1024)

Without including it in single quotes, the dot is treated as concatenation operator and it's looking for two fields fileinfo and size to concatenate values, and which probably are not available.

0 Karma

Vijeta
Influencer

@Michael Try renaming fileinfo.size.

index=suricata event_type=fileinfo| rename fileinfo.size as size |eval sizeK=(size/1024)
0 Karma

Michael
Contributor

OMG, that fixed it. That was making me nuts!

That's just silly that it can't handle that fieldname (I even tried "fileinfo.size" and 'fileinfo.size').

Thanks!

0 Karma

Vijeta
Influencer

@Michael If it has worked for you, please do accept the answer. Thanks!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...