Search

chinmay25 · ‎01-25-2021

I am using the following eval command. I want the type column to pick up both the sources. index=xyz (source=smf015 OR source=smf014) | stats values(source) as source by JFCBDSNM DATETIME S...

Ning · ‎03-04-2021

Hi All, Is it possible to perform Eval then perform lookup ? If the eval return null then perform lookupA.csv. If eval return notnull, then perform lookupB.csv thanks!

slipinski · ‎05-11-2020

Hi all, During evaluating round I got the error: | stats avg(duration) AS "booking average time" by hours | eval "booking average time"=round("booking average time",2) Error in 'eval' c...

PickleRick

We all know that manipulating _MetaData:Index we can redirect some events to another index. But the question is - can we do it using Ingest-time evals? For example - using lookup() function to s...

Marco · ‎12-04-2020

Hello Splunkers, I am trying to write is a condition that says if command starts with "CHA" or "INS" add one. The Query: host=*| eval AUDIT=if(like(COMMAND,"CHA % AUDIT%", "INS % AUDIT%"),1...

IRHM73 · ‎02-25-2019

Hi, I wonder whether someone can help me please. I'm using number the following as part of a query to extract data from a summary Index | stats count(eval(repayments_submit="1")) as r...

zoe

...bsp; Product , a, b, c, d, In_Spec I would like to use eval to assign the value to In_Spec |eval In_Spec=( if Product=1 and a1<a<a2 and b1<b<b2 and c1<c<c2, "yes", "no") b...

gnovak · ‎08-09-2012

...t;.+?)$" | search filename=Invoice.pdf OR filename=Statement.pdf OR filename=text.txt OR filename=*-*.pdf OR filename=*-*_invoice.html NOT filename=*-*_*.pdf | eval Actual=case(filename="S...

indigo42 · ‎10-15-2020

...s formatted in proper json "tree" view and color coding in Search. Ansible app uses the _json source type. When I tried to use . ...| eval foo = json_extract(<objectname>) | table foo I...

Mary666

...s output TimeSchedule should be 2021-03-06 23:37:59.000000 | makeresults | eval zipTime="2021-03-06 23:35:59.000" | eval zipTime_epoch=strptime(zipTime, "%Y-%m-%d %H:%M:%S.%6N") | eval l...

Search

Search the Community

Help with Eval command!!

Eval Lookup

eval round

EVAL-based index redirection?

EVAL Command Help

Stats Count Eval If

Eval with conditions

eval wildcards

Eval JSON_EXTRACT Issues

Eval Case Sequence on Conditions