Splunk Search

Subtracting from multiple columns

Rjbeckwith
Explorer

Hi all, I have a table like this

_timefile1.txtfile2.txtfile3.txt*.txt
1472160022
147216002214721600001472160099...
1472160024
1472160100
1472160300
1472160040...
...
............


The filename columns are all of the format *.txt but there are so many and they can change in the future that I don't want to hardcode them.
I would like to subtract the *.txt from the the _time column
I basically want to do  

 

eval *.txt = _time-*.txt

 

 Which would theoretically give these values:

_timefile1.txtfile2.txtfile3.txt*.txt
1472160022
022-77...
1472160024
-76
-276
-16...
...
............


But I can't seem to wildcard in the subtraction in the eval. Any ideas are much appreciated! 

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @Rjbeckwith,

Please try below;

| foreach "*.txt" [eval "<<MATCHSTR>>.txt" = _time - '<<FIELD>>' ]
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @Rjbeckwith,

Please try below;

| foreach "*.txt" [eval "<<MATCHSTR>>.txt" = _time - '<<FIELD>>' ]
If this reply helps you an upvote and "Accept as Solution" is appreciated.

ITWhisperer
SplunkTrust
SplunkTrust

Try foreach *.txt to apply and operation to each field matching *.txt

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Request for Professional Development: Attending .conf26

Winning Over the Boss: Your Pass to .conf26 conf26 is going to be here before you know it. If don't already ...

Casting Call: Compete in Cyber Games

Lights, Camera, SecOps: Apply to Compete in Cyber Games     Think you have what it takes to beat the clock? ...