Splunk Search

Sum fields

isachristophe
New Member

I would like realize a sum of data like that par exemple :

data = data + val1

But splunk dioesn’t recognize this sum.

Do you know I can do that ?

0 Karma

mayurr98
Super Champion

can you provide entire query in 101010 sample code format?also can you provide some sample input and output you want ??

0 Karma

493669
Super Champion

Hi @isachristophe,
try to convert string into number by convert command

<base search>| convert num(data) as data |eval data = data + val1
0 Karma

isachristophe
New Member

No it doesn’t work .
Even if you put this instruction :
Convert num (compteur) as compteur | eval compteur = compteur + 1 | table compteur

You have nothing in compteur

0 Karma

493669
Super Champion

what value is present in compteur?
and have you tried same code...as I can see space in between num and (.
provide entire query in 101010 sample code format.

0 Karma

isachristophe
New Member

I would like to put in compteur the precedent value of the iteration, but it seems impossible

0 Karma

493669
Super Champion

provide sample input and output you expect

0 Karma

493669
Super Champion
| makeresults |   eval data="111222" 
 | eval val1=666 
 | convert num(data)     | eval data = data + val1
 | table data

Its working fine...given result as "111888"

0 Karma

ddrillic
Ultra Champion

If you can try please -

index="<any_index>" 
| eval data="111222" 
| eval val1=666 
| convert num(data) as data 
| eval data = data + val1
| table data
0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...