You can use the if() function in eval, along with the substr() function to check the last character of the diskin field:
... | eval bytes=if(substr(diskin,-1)=="M",diskin/(1024*1024),diskin/1024)
If you have more than two cases, it's cleaner to use the case() function. Even with only 2 cases, it's a bit of a tossup. Here's the same functionality but with the case() function.
...| eval bytes=case(substr(diskin,-1)=="M",diskin/(1024*1024), substr(diskin,-1)=="K", ,diskin/1024)
http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/CommonEvalFunctions
UPDATE:
Sorry I forgot that those suffixes will prevent the field from being treated as a numeric field. Splunk will sometimes forgive a certain amount of strangeness and treat values as numeric anyway, but indeed it does not in this case and the division above fails.
But you can easily make yourself a numeric field by clipping off the suffix, and the overall search language then looks like:
with the eval command's if() function:
... | eval suffix=substr(diskin,-1) | eval value=substr(diskin,0,length(diskin)-1) | eval bytes=if(suffix=="M",value/(1024*1024),value/1024)
with the case() function instead:
... | eval suffix=substr(diskin,-1) | eval value=substr(diskin,0,length(diskin)-1) | eval bytes=case(suffix=="M",value/(1024*1024),suffix=="K",value/1024)
