Splunk Search

Subtracting from multiple columns

Rjbeckwith
Explorer

Hi all, I have a table like this

_timefile1.txtfile2.txtfile3.txt*.txt
1472160022
147216002214721600001472160099...
1472160024
1472160100
1472160300
1472160040...
...
............


The filename columns are all of the format *.txt but there are so many and they can change in the future that I don't want to hardcode them.
I would like to subtract the *.txt from the the _time column
I basically want to do  

 

eval *.txt = _time-*.txt

 

 Which would theoretically give these values:

_timefile1.txtfile2.txtfile3.txt*.txt
1472160022
022-77...
1472160024
-76
-276
-16...
...
............


But I can't seem to wildcard in the subtraction in the eval. Any ideas are much appreciated! 

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @Rjbeckwith,

Please try below;

| foreach "*.txt" [eval "<<MATCHSTR>>.txt" = _time - '<<FIELD>>' ]
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @Rjbeckwith,

Please try below;

| foreach "*.txt" [eval "<<MATCHSTR>>.txt" = _time - '<<FIELD>>' ]
If this reply helps you an upvote and "Accept as Solution" is appreciated.

ITWhisperer
SplunkTrust
SplunkTrust

Try foreach *.txt to apply and operation to each field matching *.txt

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...