How to use eval to do simple conversion?

[Michael]

Wow, I can't believe this is kicking my butt -- think I need an idiot check... (yes, I know... 😉

I'm trying to do a simple conversion: sizeK=(fileinfo.size/1024) but it's failing. I've done these hundreds of times before, and have it documented in my notes from years ago. Oh, and triple checked it here against multiple examples.

The whole line is simply:

index=suricata event_type=fileinfo| eval sizeK=(fileinfo.size/1024)

It's not creating "sizeK".

When I change to:

| eval sizeK=round(fileinfo.size/1024)

or

| eval sizeK=round(fileinfo.size/1024,2)

I get: "Error in 'eval' command: The arguments to the 'round' function are invalid. "

Even tried:

| eval sizeK=fileinfo.size/1024

Still no workie. Suggestions?

[somesoni2]

Your field name contains special character (dot, even hyphen and spaces will cause this) so when referencing it in expression parts (RHS of eval OR in where clause), you need to include it in single quotes, like this:

index=suricata event_type=fileinfo| eval sizeK=('fileinfo.size'/1024)

Without including it in single quotes, the dot is treated as concatenation operator and it's looking for two fields fileinfo and size to concatenate values, and which probably are not available.

[Vijeta · Accepted solution]

@Michael Try renaming fileinfo.size.

index=suricata event_type=fileinfo| rename fileinfo.size as size |eval sizeK=(size/1024)

[Michael]

OMG, that fixed it. That was making me nuts!

That's just silly that it can't handle that fieldname (I even tried "fileinfo.size" and 'fileinfo.size').

Thanks!

[Vijeta]

@Michael If it has worked for you, please do accept the answer. Thanks!