I have a form that prompts user for a 4 digit number representing a location. I want to insert that location number into a formula that calculates the location's IP address. I then want to use that IP as the basis for a search.
My formula with a location number of 0191 looks like this:
The resulting IP address is 10.170.191.48
I then hope to use the IP is the following search:
So I think I would use EVAL as follows:
index="winradius" (eval nps_nasIP=10.(INT(0191/256+170)).(MOD(0191,256)).48)
But this doesn't work.
No error message... just no results are returned.
Not sure how to fix or even troubleshoot this.
You could do this using a subsearch:
index="winradius" [ | stats count | eval nps_nasIP="10." . tostring(floor(tonumber("0191")/256+170)) . "." . tostring(tonumber("0191")%256) . ".48" | return nps_nasIP ]
Can you tell me if, rather they trying to evaluate the formula within the search string, I can insert some code into the form... so that when the user enters 0191, the form calls a script to apply the formula and then inserts he result to the search?
it should work, at least on 4.3. The subsearch creates an additional condition for the outer search
The dot characeter
. is used for string concatenation.
There's no INT and MOD function for Splunk's eval command so I changed them to
INT ==> floor(tonumber(X)) and
MOD ==> X%Y
Here's a list of functions you can use with the eval command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions
A couple of things....
1 - thanks for the very quick reply!
2 - unfortunately it doesn't work
3 - what does this string do . "." .
4 - in my formula INT and MOD are mathematical functions so I would not expect replacing the function names with "tonumber" to return the expected result
INT means "round the result to nearest whole number"
MOD(191/256) means "tell me the remainder if 191 is devided by 265"