Splunk Search

declare a variable in search string

Path Finder

I have a search string (given below). Now I want to declare a variable named Os_Type, which based on the source type, will provide me OS Type.

index=os source=Perfmon:LocalLogicalDisk
| where like(counter, "% Free Space")
| stats avg(Value) as "availDiskPct" by host
| eval availDiskPct=round(availDiskPct, 2)

Now I have tried with
eval Os_Type=if($source$==":","WINDOWS","unix")
but it is not giving me the correct result.

Please help me!!!

Tags (4)
1 Solution

Legend

You're correct in that you should be using eval, but your eval statement looks a bit off. As it is now, "Os_Type" would only get the value "WINDOWS" if the source field is EXACTLY ":". Did you mean that it should CONTAIN ":"? If so, you should do something like

... | eval Os_Type=if(match(source,":"),"WINDOWS","unix")

View solution in original post

Legend

You're correct in that you should be using eval, but your eval statement looks a bit off. As it is now, "Os_Type" would only get the value "WINDOWS" if the source field is EXACTLY ":". Did you mean that it should CONTAIN ":"? If so, you should do something like

... | eval Os_Type=if(match(source,":"),"WINDOWS","unix")

View solution in original post

New Member

After declaring the variable will you be able to use Os_Type in calculating other fieldvalues?

0 Karma

Path Finder

Thank you!!!

0 Karma

Legend

Something like

index=os source=Perfmon:LocalMainMemory | where like(counter,"% Committed Bytes In Use") | eval Os_Type=if(source=="Perfmon:LocalMainMemory","WINDOWS","Unix") | stats avg(Value) as "avgMemPct", max(Value) as "peakMemPct" by host,Os_Type | eval avgMemPct=round(avgMemPct,2) | eval peakMemPct=round(peakMemPct,2)

should do it.

Path Finder

tried to find how can we use split by...but did not find luck...can you please tell me the syntax for the same?

0 Karma

Legend

Ah, I see now - you're putting your eval after the stats command. The only field output from stats will be the fields that it produces - in your case avgMemPct, peakMemPct and host. So, when you're doing your eval statement at the end, the source field no longer exists. You need to put the eval before your stats command and then do something like splitting by host AND Os_Type in order to get it to show in your results.

0 Karma

Path Finder

even if I am trying to search the below mentioned string:

index=os source=Perfmon:LocalMainMemory
| where like(counter,"% Committed Bytes In Use")
| stats avg(Value) as "avgMemPct", max(Value) as "peakMemPct" by host
| eval avgMemPct=round(avgMemPct,2)
| eval peakMemPct=round(peakMemPct,2)
| eval Os_Type=if(source=="Perfmon:LocalMainMemory","WINDOWS","Unix")

the result is coming as Unix ...is there any problem with the conditional operator..

0 Karma

Path Finder

I meant that : should be present in the source. I tried with what you have suggested...but it is giving me the wrong result.

0 Karma