Splunk Search

Splunk Simple Math Expression using Eval

plunkzombie
Engager

I need a way to evaluate a simple math expression.

The following query works, and expr evaluates to result with a value of 44.

 

| makeresults 
| eval result=
	[| makeresults count=1 
	| noop 
	| head 1 
	| eval expr = "1*2+3*4+5*6"
	| return $expr]

 

But, I need to make the following type of query work.

 

| gentimes start=-1 
| eval expr = "1*2+3*4+5*6"
| table expr, $expr

 

Is there a way to do this ?

Thanks.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Perhaps a bit convoluted by try something like this

| gentimes start=-1 
| eval expr = "1*2+3*4+5*6"
| foreach expr
	[| eval return_{<<FIELD>>} = <<FIELD>>]
| foreach return_*
    [| eval return=<<MATCHSEG1>>]

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Perhaps a bit convoluted by try something like this

| gentimes start=-1 
| eval expr = "1*2+3*4+5*6"
| foreach expr
	[| eval return_{<<FIELD>>} = <<FIELD>>]
| foreach return_*
    [| eval return=<<MATCHSEG1>>]
0 Karma

plunkzombie
Engager

Thank you so much. This works!

0 Karma

plunkzombie
Engager

This was just an example to show the problem that I am facing.

In the real splunk query where I need to make this work, that 'expr' gets constructed as part of the query evaluation, and is different for different rows of the table.  There is no "quotation" marks, and it is a string type. 

 

0 Karma

Alisher
Engager

Hello @plunkzombie,

It seems you just need to get rid of the quotation marks.

Try this:

| gentimes start=-1
| eval expr = 1*2+3*4+5*6


KR,
A. 

0 Karma
Get Updates on the Splunk Community!

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...