I have 2 fields i.e. Currency and Amount. I want to convert amount with its associated currency into INR format so that I can sum it up and calculate revenue.

[mayurr98]

Currency Amount
USD 2
INR 3
AED 5
6
8
20
AND SO ON.
suppose 2 has currency USD . 3 has currency INR. 5 has currency USD
I want to convert this values into dafault INR. and then I want to sum all those values.how do I do?

[woodcock]

Start here:

http://docs.splunk.com/Documentation/Splunk/6.0/Search/Usesearchmacros

Then you need to lookup how to convert between currencies. For Euros to Dollars, your macro would start and end like this (you fill in the middle):

eval INR = case(Currency="INR", Amount,
                Currency="USD", Amount * 67.28,
                             ...
                true(), "ERROR: UNKNOWN CURRENCY!")

[woodcock]

Build a macro that does this conversion for you and call it like this:

your search here | `YourMacroHere(Currency, Amount)`

[mayurr98]

what macro query should I put for conversion. I am new to splunk. Can you pls tell me