Splunk Search

Splunk Simple Math Expression using Eval

plunkzombie
Engager

I need a way to evaluate a simple math expression.

The following query works, and expr evaluates to result with a value of 44.

 

| makeresults 
| eval result=
	[| makeresults count=1 
	| noop 
	| head 1 
	| eval expr = "1*2+3*4+5*6"
	| return $expr]

 

But, I need to make the following type of query work.

 

| gentimes start=-1 
| eval expr = "1*2+3*4+5*6"
| table expr, $expr

 

Is there a way to do this ?

Thanks.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Perhaps a bit convoluted by try something like this

| gentimes start=-1 
| eval expr = "1*2+3*4+5*6"
| foreach expr
	[| eval return_{<<FIELD>>} = <<FIELD>>]
| foreach return_*
    [| eval return=<<MATCHSEG1>>]

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Perhaps a bit convoluted by try something like this

| gentimes start=-1 
| eval expr = "1*2+3*4+5*6"
| foreach expr
	[| eval return_{<<FIELD>>} = <<FIELD>>]
| foreach return_*
    [| eval return=<<MATCHSEG1>>]
0 Karma

plunkzombie
Engager

Thank you so much. This works!

0 Karma

plunkzombie
Engager

This was just an example to show the problem that I am facing.

In the real splunk query where I need to make this work, that 'expr' gets constructed as part of the query evaluation, and is different for different rows of the table.  There is no "quotation" marks, and it is a string type. 

 

0 Karma

Alisher
Engager

Hello @plunkzombie,

It seems you just need to get rid of the quotation marks.

Try this:

| gentimes start=-1
| eval expr = 1*2+3*4+5*6


KR,
A. 

0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...