Need to convert only MB values to GB leaving GB values as it is.

[Mrig342]

Hi All,

I have logs like below in splunk:

Log1: Tue Feb 25 04:00:20 2024 EST 10G 59M 1% /apps
Log2: Tue Feb 25 04:00:20 2024 EST 10G 6.4G 64% /logs
Log3: Tue Feb 25 04:00:20 2024 EST 10G 2G 20% /opt
Log4: Tue Feb 25 04:00:20 2024 EST 30G 282M 1% /var

 I have used the below query to extract the required fields:

... | rex field=_raw "EST\s(?P<Total_Space>[^\s]+)\s(?P<Used_Space>[^\s]+)\s(?P<Disk_Usage>[^%]+)\%\s(?P<File_System>[^\s]+)"

Here, the output values of "Used_Space" field has both GB and MB values and I need to convert only MB values to GB. 

Please help to create a query to get the MB values only converted to GB.

Your kind inputs are highly appreciated..!!

Thank You..!!

[scelikok]

Hi @Mrig342,

You can use below eval function;

| eval Used_Space=case(match(Used_Space,"M"),round(tonumber(replace(Used_Space,"M",""))/1024,2)."G",1=1,Used_Space)

[Mrig342]

Hi @scelikok 

Thank you for the query.. But its not working for me.. Its giving error:

Error in 'EvalCommand': The expression is malformed. Expected).

Can you please help to modify the query..

Thank you..!!

[scelikok]

Hi @Mrig342 ,

It is a tested solution in my lab environment. Can you please check if the double quotes are the correct characters in your search? Sometimes they got replaced while copying from the browser.

[Mrig342 · Accepted solution]

Hi @scelikok ,

I modified the query as below and now its working fine for me.

| eval Used_Space=case(match(Used_Space,"M"),round(tonumber(replace(Used_Space,"M",""))/1024,2), match(Used_Space,"G"),Used_Space)

Thank you for your inputs though..!!