Splunk Search

I have 2 fields i.e. Currency and Amount. I want to convert amount with its associated currency into INR format so that I can sum it up and calculate revenue.

mayurr98
Super Champion

Currency Amount
USD 2
INR 3
AED 5
6
8
20
AND SO ON.
suppose 2 has currency USD . 3 has currency INR. 5 has currency USD
I want to convert this values into dafault INR. and then I want to sum all those values.how do I do?

0 Karma

woodcock
Esteemed Legend

Start here:

http://docs.splunk.com/Documentation/Splunk/6.0/Search/Usesearchmacros

Then you need to lookup how to convert between currencies. For Euros to Dollars, your macro would start and end like this (you fill in the middle):

eval INR = case(Currency="INR", Amount,
                Currency="USD", Amount * 67.28,
                             ...
                true(), "ERROR: UNKNOWN CURRENCY!")
0 Karma

woodcock
Esteemed Legend

Build a macro that does this conversion for you and call it like this:

your search here | `YourMacroHere(Currency, Amount)`
0 Karma

mayurr98
Super Champion

what macro query should I put for conversion. I am new to splunk. Can you pls tell me

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...