Splunk Search

Usage suggestion for eval

brettcave
Builder

It would be great if "eval" could do multiple evaluations in a single command, in a similar way that "stats" can:

stats sum(someField) as "sumField" sum(otherField) as "sumOtherField"

and with eval:

... | eval field1=(eval statement) field2=(eval statement)

instead of | eval | eval | eval

Tags (2)
1 Solution

BobM
Builder

Yes it would but this isn't a question. I suggest you contact support asking for this as an enhancement request.

View solution in original post

BobM
Builder

Yes it would but this isn't a question. I suggest you contact support asking for this as an enhancement request.

brettcave
Builder

ok, sorry, thought this forum could be used for suggestions / feedback around ideas.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...