Splunk Search

Wildcard eval to divide multiple values with a constant number like 2

batcave
Explorer

I have a search which gets timings across many Streets. But these times are in seconds and I want to convert to minutes. Is there a way to wildcard eval all these values?

e.g.

timechart perc95(*Street) AS *Street  -- > values are in seconds 

I want something in minutes like this:

e.g.

timechart perc95(*Street)/60 AS *Street  --> Ofcourse this doesnt work but you get the idea I think.
Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

My boss has allowed me some time to build a wildcard-capable scaling command 🙂

0 Karma

batcave
Explorer

yep true. that's why searching for a way to do it alternatively

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

eval doesn't do wildcards, they get confused with the multiplication sign.

0 Karma

batcave
Explorer

anyone have an answer to this? anyone from Splunk?

0 Karma

batcave
Explorer

By doing *Street, I can get all timechart of all the fields ending with "Street" for e.g. BrooklynStreet,WestStreet,etc.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Just to clarify, there are wildcards hidden in the formatting, right?

timechart perc95(*Street) AS *Street
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...