Splunk Search

declare a variable in search string

Splunk_U
Path Finder

I have a search string (given below). Now I want to declare a variable named Os_Type, which based on the source type, will provide me OS Type.

index=os source=Perfmon:LocalLogicalDisk
| where like(counter, "% Free Space")
| stats avg(Value) as "availDiskPct" by host
| eval availDiskPct=round(availDiskPct, 2)

Now I have tried with
eval Os_Type=if($source$==":","WINDOWS","unix")
but it is not giving me the correct result.

Please help me!!!

Tags (4)
1 Solution

Ayn
Legend

You're correct in that you should be using eval, but your eval statement looks a bit off. As it is now, "Os_Type" would only get the value "WINDOWS" if the source field is EXACTLY ":". Did you mean that it should CONTAIN ":"? If so, you should do something like

... | eval Os_Type=if(match(source,":"),"WINDOWS","unix")

View solution in original post

Ayn
Legend

You're correct in that you should be using eval, but your eval statement looks a bit off. As it is now, "Os_Type" would only get the value "WINDOWS" if the source field is EXACTLY ":". Did you mean that it should CONTAIN ":"? If so, you should do something like

... | eval Os_Type=if(match(source,":"),"WINDOWS","unix")

muthvin
New Member

After declaring the variable will you be able to use Os_Type in calculating other fieldvalues?

0 Karma

Splunk_U
Path Finder

Thank you!!!

0 Karma

Ayn
Legend

Something like

index=os source=Perfmon:LocalMainMemory | where like(counter,"% Committed Bytes In Use") | eval Os_Type=if(source=="Perfmon:LocalMainMemory","WINDOWS","Unix") | stats avg(Value) as "avgMemPct", max(Value) as "peakMemPct" by host,Os_Type | eval avgMemPct=round(avgMemPct,2) | eval peakMemPct=round(peakMemPct,2)

should do it.

Splunk_U
Path Finder

tried to find how can we use split by...but did not find luck...can you please tell me the syntax for the same?

0 Karma

Ayn
Legend

Ah, I see now - you're putting your eval after the stats command. The only field output from stats will be the fields that it produces - in your case avgMemPct, peakMemPct and host. So, when you're doing your eval statement at the end, the source field no longer exists. You need to put the eval before your stats command and then do something like splitting by host AND Os_Type in order to get it to show in your results.

0 Karma

Splunk_U
Path Finder

even if I am trying to search the below mentioned string:

index=os source=Perfmon:LocalMainMemory
| where like(counter,"% Committed Bytes In Use")
| stats avg(Value) as "avgMemPct", max(Value) as "peakMemPct" by host
| eval avgMemPct=round(avgMemPct,2)
| eval peakMemPct=round(peakMemPct,2)
| eval Os_Type=if(source=="Perfmon:LocalMainMemory","WINDOWS","Unix")

the result is coming as Unix ...is there any problem with the conditional operator..

0 Karma

Splunk_U
Path Finder

I meant that : should be present in the source. I tried with what you have suggested...but it is giving me the wrong result.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...