Splunk Search

Subtracting from multiple columns

Rjbeckwith
Explorer

Hi all, I have a table like this

_timefile1.txtfile2.txtfile3.txt*.txt
1472160022
147216002214721600001472160099...
1472160024
1472160100
1472160300
1472160040...
...
............


The filename columns are all of the format *.txt but there are so many and they can change in the future that I don't want to hardcode them.
I would like to subtract the *.txt from the the _time column
I basically want to do  

 

eval *.txt = _time-*.txt

 

 Which would theoretically give these values:

_timefile1.txtfile2.txtfile3.txt*.txt
1472160022
022-77...
1472160024
-76
-276
-16...
...
............


But I can't seem to wildcard in the subtraction in the eval. Any ideas are much appreciated! 

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @Rjbeckwith,

Please try below;

| foreach "*.txt" [eval "<<MATCHSTR>>.txt" = _time - '<<FIELD>>' ]
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @Rjbeckwith,

Please try below;

| foreach "*.txt" [eval "<<MATCHSTR>>.txt" = _time - '<<FIELD>>' ]
If this reply helps you an upvote and "Accept as Solution" is appreciated.

ITWhisperer
SplunkTrust
SplunkTrust

Try foreach *.txt to apply and operation to each field matching *.txt

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...