Splunk Search

Subtracting from multiple columns

Rjbeckwith
Explorer

Hi all, I have a table like this

_timefile1.txtfile2.txtfile3.txt*.txt
1472160022
147216002214721600001472160099...
1472160024
1472160100
1472160300
1472160040...
...
............


The filename columns are all of the format *.txt but there are so many and they can change in the future that I don't want to hardcode them.
I would like to subtract the *.txt from the the _time column
I basically want to do  

 

eval *.txt = _time-*.txt

 

 Which would theoretically give these values:

_timefile1.txtfile2.txtfile3.txt*.txt
1472160022
022-77...
1472160024
-76
-276
-16...
...
............


But I can't seem to wildcard in the subtraction in the eval. Any ideas are much appreciated! 

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @Rjbeckwith,

Please try below;

| foreach "*.txt" [eval "<<MATCHSTR>>.txt" = _time - '<<FIELD>>' ]
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @Rjbeckwith,

Please try below;

| foreach "*.txt" [eval "<<MATCHSTR>>.txt" = _time - '<<FIELD>>' ]
If this reply helps you an upvote and "Accept as Solution" is appreciated.

ITWhisperer
SplunkTrust
SplunkTrust

Try foreach *.txt to apply and operation to each field matching *.txt

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Make your Splunk investment work harder with Optimization Advisor

Value Insights brings usage evidence and practical recommendations together to help customers make more ...

How Splunk AI Assistant Is Transforming Investigations: Insights from .conf26

At .conf26 in Denver, I spent much of my time in conversation with Splunk customers about Splunk AI Assistant. ...

Make Your Machine Data AI-Ready in Splunk

Every team is getting ready for AI agents.   Thursday, November 12, 2026  |  11AM  PST / 2PM EST   ...