Splunk Search

Is there any way to pre-calculate the difference between two fields and keep this delta as a new field for future searches?

Path Finder

Data:

 departure_time1, departure_time2, arrival_time1, arrival_time2 

All the fields are in string.

My searches evaluate (departuretime2 - departuretime1) & (arrivaltime2 - arrivaltime1 ) to calculate time spans to add two new fields.

 departure_time1, departure_time2, arrival_time1, arrival_time2, departure_span, arrival_span

All my searches are based on filters/ranking on departurespan and arrivalspan. The queries are originating from a Web app.

Question:
Is there any way in which I can pre-calculate these fields and keep them for future searches?

0 Karma

Splunk Employee
Splunk Employee

You can move those "eval" calculations to the sourcetype... and then your two additional fields will always be there. check out the doc for props.conf and look for "EVAL" directive. Or you can do it through the GUI: settings>fields>calculated fields.

EVAL-<fieldname> = <eval statement>
* Use this to automatically run the <eval statement> and assign the value of the output 
  to <fieldname>. This creates a "calculated field."
* When multiple EVAL-* statements are specified, they behave as if 
  they are run in parallel, rather than in any particular sequence.  
  For example say you have two statements: EVAL-x = y*2 and EVAL-y=100. In this case, "x" 
  will be assigned the original value of "y * 2," not the value of "y" after it is set to 100.
* Splunk processes calculated fields after field extraction and field aliasing but before 
  lookups. This means that:
        * You can use a field alias in the eval statement for a calculated field.
        * You cannot use a field added through a lookup in an eval statement for a calculated
          field. 
With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma