Length of every column in a table?

[bofasplunkguy]

I have a table with ~50 columns. I am doing an addcoltotals on the table, but this only adds up the numeric fields. Can someone please suggest an elegant way to take the length of every field in the table so addcoltotals populates for each column? Right now, the best I can think of is:

|eval field1Len = len(field1)
| eval field2len = len(field2)
...
|eval field50len = len(field50)

Would love a len(*) sort of approach if possible. Ideally I won't have to rewrite 50 eval statements. Hoping to build a sort of "checksum" so that we can measure table updates without looking through the rows. Any ideas appreciated!

[sandeepmakkena]

You can use for loop,

 index=****
    | table ColumnName
    | foreach ColumnName
        [eval length =len(ColumnName)]
    | table ColumnName, length

Hope this will help. Thanks!

[vasanthmss · Accepted solution]

Hi Bofasplunkguy,

Try using foreach command. This will save multiple eval statements..

... your base search  | foreach field* [| eval <<FIELD>>_Len=len(<<FIELD>>)] 

Description:

field* will iterate the all the field1, field2..
<<FIELD>> will be the actual field field1, field2 ...
<<FIELD>>_Len will be a new field with the eval len() accordingly.

Foreach syntax,

 foreach <wc-field>... [fieldstr=<string>] [matchstr=<string>] [matchseg1=<string>] [matchseg2=<string>] [matchseg3=<string>] <subsearch> 

For more details https://docs.splunk.com/Documentation/SplunkCloud/7.2.7/SearchReference/Foreach

Hope this helps you

Cheerss!!!

[bofasplunkguy]

Thank you! This worked and my code is way cleaner. I added quotation marks in the eval command portion like the docs recommend just to be safe:

| foreach * [eval <>Len=len('<>')]