Splunk Search

Wildcard eval to divide multiple values with a constant number like 2

Explorer

I have a search which gets timings across many Streets. But these times are in seconds and I want to convert to minutes. Is there a way to wildcard eval all these values?

e.g.

timechart perc95(*Street) AS *Street  -- > values are in seconds 

I want something in minutes like this:

e.g.

timechart perc95(*Street)/60 AS *Street  --> Ofcourse this doesnt work but you get the idea I think.
Tags (3)
0 Karma

SplunkTrust
SplunkTrust
0 Karma

SplunkTrust
SplunkTrust

My boss has allowed me some time to build a wildcard-capable scaling command 🙂

0 Karma

Explorer

yep true. that's why searching for a way to do it alternatively

0 Karma

SplunkTrust
SplunkTrust

eval doesn't do wildcards, they get confused with the multiplication sign.

0 Karma

Explorer

anyone have an answer to this? anyone from Splunk?

0 Karma

Explorer

By doing *Street, I can get all timechart of all the fields ending with "Street" for e.g. BrooklynStreet,WestStreet,etc.

0 Karma

SplunkTrust
SplunkTrust

Just to clarify, there are wildcards hidden in the formatting, right?

timechart perc95(*Street) AS *Street
0 Karma