Search

shreyasamin64 · ‎11-30-2021

need help on eval function of trimming the month EX : April = APR all months first 3 letters thanks

Ning · ‎03-04-2021

Hi All, Is it possible to perform Eval then perform lookup ? If the eval return null then perform lookupA.csv. If eval return notnull, then perform lookupB.csv thanks!

slipinski · ‎05-11-2020

Hi all, During evaluating round I got the error: | stats avg(duration) AS "booking average time" by hours | eval "booking average time"=round("booking average time",2) Error in 'eval' c...

jip31

hello In my search I use an eval command like below in order to identify character string in web url | eval Kheo=case( like(url,"%SLG%"),"G", like(url,"%SLK%"),"G", like(url,"%SLY%"),"I...

Tika · ‎02-13-2022

Hello, I am new to Splunk and this is probably a basic query. I have a field with an email address and I want to check if the email exists in a look up table and eval it to 1, if found and 0 i...

shreyasamin64 · ‎11-26-2021

| eval new_name=mvindex(split(name, ","),0), first name 0 and last name 1 split first and last name why split and 0&1 used in the pipeline

IRHM73 · ‎02-25-2019

Hi, I wonder whether someone can help me please. I'm using number the following as part of a query to extract data from a summary Index | stats count(eval(repayments_submit="1")) as r...

vanheer · ‎04-13-2022

Hi, I have multiple fields like, counting how many items passing through gates: | timechart count(eval(like(gate_id, "RG%") )) as items_RG, count(eval(NOT like(g...

chinmay25 · ‎01-25-2021

I am using the following eval command. I want the type column to pick up both the sources. index=xyz (source=smf015 OR source=smf014) | stats values(source) as source by JFCBDSNM DATETIME S...

gnovak · ‎08-09-2012

...t;.+?)$" | search filename=Invoice.pdf OR filename=Statement.pdf OR filename=text.txt OR filename=*-*.pdf OR filename=*-*_invoice.html NOT filename=*-*_*.pdf | eval Actual=case(filename="S...

Search

Search the Community

eval function

Eval Lookup

eval round

help on eval like condition

Eval against a lookup

help with EVAL command

Stats Count Eval If

How to combine timechart, stats, and eval?

Help with Eval command!!

eval wildcards