Splunk Search
Highlighted

How to use eval to do simple conversion?

Contributor

Wow, I can't believe this is kicking my butt -- think I need an idiot check... (yes, I know... 😉

I'm trying to do a simple conversion: sizeK=(fileinfo.size/1024) but it's failing. I've done these hundreds of times before, and have it documented in my notes from years ago. Oh, and triple checked it here against multiple examples.

The whole line is simply:

index=suricata event_type=fileinfo| eval sizeK=(fileinfo.size/1024)

It's not creating "sizeK".

When I change to:

| eval sizeK=round(fileinfo.size/1024)

or

| eval sizeK=round(fileinfo.size/1024,2)

I get: "Error in 'eval' command: The arguments to the 'round' function are invalid. "

Even tried:

| eval sizeK=fileinfo.size/1024

Still no workie. Suggestions?

Tags (2)
0 Karma
Highlighted

Re: How to use eval to do simple conversion?

Influencer

@Michael Try renaming fileinfo.size.

index=suricata event_type=fileinfo| rename fileinfo.size as size |eval sizeK=(size/1024)

View solution in original post

0 Karma
Highlighted

Re: How to use eval to do simple conversion?

Contributor

OMG, that fixed it. That was making me nuts!

That's just silly that it can't handle that fieldname (I even tried "fileinfo.size" and 'fileinfo.size').

Thanks!

0 Karma
Highlighted

Re: How to use eval to do simple conversion?

Influencer

@Michael If it has worked for you, please do accept the answer. Thanks!

0 Karma
Highlighted

Re: How to use eval to do simple conversion?

SplunkTrust
SplunkTrust

Your field name contains special character (dot, even hyphen and spaces will cause this) so when referencing it in expression parts (RHS of eval OR in where clause), you need to include it in single quotes, like this:

index=suricata event_type=fileinfo| eval sizeK=('fileinfo.size'/1024)

Without including it in single quotes, the dot is treated as concatenation operator and it's looking for two fields fileinfo and size to concatenate values, and which probably are not available.

0 Karma