Splunk Search

Splunk Simple Math Expression using Eval

plunkzombie
Engager

I need a way to evaluate a simple math expression.

The following query works, and expr evaluates to result with a value of 44.

 

| makeresults 
| eval result=
	[| makeresults count=1 
	| noop 
	| head 1 
	| eval expr = "1*2+3*4+5*6"
	| return $expr]

 

But, I need to make the following type of query work.

 

| gentimes start=-1 
| eval expr = "1*2+3*4+5*6"
| table expr, $expr

 

Is there a way to do this ?

Thanks.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Perhaps a bit convoluted by try something like this

| gentimes start=-1 
| eval expr = "1*2+3*4+5*6"
| foreach expr
	[| eval return_{<<FIELD>>} = <<FIELD>>]
| foreach return_*
    [| eval return=<<MATCHSEG1>>]

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Perhaps a bit convoluted by try something like this

| gentimes start=-1 
| eval expr = "1*2+3*4+5*6"
| foreach expr
	[| eval return_{<<FIELD>>} = <<FIELD>>]
| foreach return_*
    [| eval return=<<MATCHSEG1>>]
0 Karma

plunkzombie
Engager

Thank you so much. This works!

0 Karma

plunkzombie
Engager

This was just an example to show the problem that I am facing.

In the real splunk query where I need to make this work, that 'expr' gets constructed as part of the query evaluation, and is different for different rows of the table.  There is no "quotation" marks, and it is a string type. 

 

0 Karma

Alisher
Engager

Hello @plunkzombie,

It seems you just need to get rid of the quotation marks.

Try this:

| gentimes start=-1
| eval expr = 1*2+3*4+5*6


KR,
A. 

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...