Why am I unable to convert my addcoltotals value of MB to TB using eval?

[dean1]

Hello Splunk Ninjas

I'm trying to convert my addcoltotals of MB to TB using the eval statement which does not work....

index=myindex sourcetype=mysourcetype | table Cluster, Capacity_MB | addcoltotals  label=TOTALS labelfield=Cluster | eval  TOTALS = round(TOTALS/1024,2)

Thanks!

[javiergn · Accepted solution]

Hi,

Your labelfield=Cluster means that's the name of the field that it's going to store the string "TOTALS".
TOTALS is not a field, it's a value. The field is Capacity_MB.

Therefore if you just want to apply it to that particular row in your table you can do it this way:

| eval Capacity_MB = if(Cluster == "TOTALS", round(Capacity_MB/1024,2), Capacity_MB)

Hope that makes sense.

Thanks,
J

[dean1]

Excellent - That worked - Thank you!