Splunk Search

converted values not displaying after rex and eval

codedtech
Path Finder

I'm trying to run this eval statement, but the only value that dispalys in the y value.

my index|rex mode=sed field=capacity_gb "s/[^\d\.,]//g"|rex mode=sed field=vmdkused_gb "s/[^\d\.,]//g"|eval x = tonumber(capacity_gb)|eval y = tonumber(vmdkalloc_gb)|eval z = y/x| table x,y,z

X           Y         Z
             Y
0 Karma

venkasplunk
New Member

From ur below statement, it looks like you are using wrong filed for value Y.

You extracted rex mode=sed field=vmdkused_gb , but you are using y = tonumber(vmdkalloc_gb) , it should be y = tonumber(vmdkused_gb) ???

index|rex mode=sed field=capacity_gb "s/[^\d.,]//g"|rex mode=sed field=vmdkused_gb "s/[^\d.,]//g"|eval x = tonumber(capacity_gb)|eval y = tonumber(vmdkalloc_gb)|eval z = y/x| table x,y,z

0 Karma

Vijeta
Influencer

can you share your events and what fields are you trying to parse.

0 Karma
Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...