Data:
departure_time1, departure_time2, arrival_time1, arrival_time2
All the fields are in string.
My searches evaluate (departure_time2 - departure_time1) & (arrival_time2 - arrival_time1 ) to calculate time spans to add two new fields.
departure_time1, departure_time2, arrival_time1, arrival_time2, departure_span, arrival_span
All my searches are based on filters/ranking on departure_span and arrival_span. The queries are originating from a Web app.
Question:
Is there any way in which I can pre-calculate these fields and keep them for future searches?
You can move those "eval" calculations to the sourcetype... and then your two additional fields will always be there. check out the doc for props.conf and look for "EVAL" directive. Or you can do it through the GUI: settings>fields>calculated fields.
EVAL-<fieldname> = <eval statement>
* Use this to automatically run the <eval statement> and assign the value of the output
to <fieldname>. This creates a "calculated field."
* When multiple EVAL-* statements are specified, they behave as if
they are run in parallel, rather than in any particular sequence.
For example say you have two statements: EVAL-x = y*2 and EVAL-y=100. In this case, "x"
will be assigned the original value of "y * 2," not the value of "y" after it is set to 100.
* Splunk processes calculated fields after field extraction and field aliasing but before
lookups. This means that:
* You can use a field alias in the eval statement for a calculated field.
* You cannot use a field added through a lookup in an eval statement for a calculated
field.