Splunk Search

Subtracting from multiple columns

Rjbeckwith
Explorer

Hi all, I have a table like this

_timefile1.txtfile2.txtfile3.txt*.txt
1472160022
147216002214721600001472160099...
1472160024
1472160100
1472160300
1472160040...
...
............


The filename columns are all of the format *.txt but there are so many and they can change in the future that I don't want to hardcode them.
I would like to subtract the *.txt from the the _time column
I basically want to do  

 

eval *.txt = _time-*.txt

 

 Which would theoretically give these values:

_timefile1.txtfile2.txtfile3.txt*.txt
1472160022
022-77...
1472160024
-76
-276
-16...
...
............


But I can't seem to wildcard in the subtraction in the eval. Any ideas are much appreciated! 

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @Rjbeckwith,

Please try below;

| foreach "*.txt" [eval "<<MATCHSTR>>.txt" = _time - '<<FIELD>>' ]
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @Rjbeckwith,

Please try below;

| foreach "*.txt" [eval "<<MATCHSTR>>.txt" = _time - '<<FIELD>>' ]
If this reply helps you an upvote and "Accept as Solution" is appreciated.

ITWhisperer
SplunkTrust
SplunkTrust

Try foreach *.txt to apply and operation to each field matching *.txt

Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...