Hi All,
I have logs like below in splunk:
Log1: Tue Feb 25 04:00:20 2024 EST 10G 59M 1% /apps
Log2: Tue Feb 25 04:00:20 2024 EST 10G 6.4G 64% /logs
Log3: Tue Feb 25 04:00:20 2024 EST 10G 2G 20% /opt
Log4: Tue Feb 25 04:00:20 2024 EST 30G 282M 1% /var
I have used the below query to extract the required fields:
... | rex field=_raw "EST\s(?P<Total_Space>[^\s]+)\s(?P<Used_Space>[^\s]+)\s(?P<Disk_Usage>[^%]+)\%\s(?P<File_System>[^\s]+)"
Here, the output values of "Used_Space" field has both GB and MB values and I need to convert only MB values to GB.
Please help to create a query to get the MB values only converted to GB.
Your kind inputs are highly appreciated..!!
Thank You..!!
Hi @scelikok ,
I modified the query as below and now its working fine for me.
| eval Used_Space=case(match(Used_Space,"M"),round(tonumber(replace(Used_Space,"M",""))/1024,2), match(Used_Space,"G"),Used_Space)
Thank you for your inputs though..!!
Hi @Mrig342,
You can use below eval function;
| eval Used_Space=case(match(Used_Space,"M"),round(tonumber(replace(Used_Space,"M",""))/1024,2)."G",1=1,Used_Space)
Hi @scelikok
Thank you for the query.. But its not working for me.. Its giving error:
Error in 'EvalCommand': The expression is malformed. Expected).
Can you please help to modify the query..
Thank you..!!
Hi @Mrig342 ,
It is a tested solution in my lab environment. Can you please check if the double quotes are the correct characters in your search? Sometimes they got replaced while copying from the browser.
Hi @scelikok ,
I modified the query as below and now its working fine for me.
| eval Used_Space=case(match(Used_Space,"M"),round(tonumber(replace(Used_Space,"M",""))/1024,2), match(Used_Space,"G"),Used_Space)
Thank you for your inputs though..!!