Splunk Search

using EVAL

mikefoti
Communicator

I have a form that prompts user for a 4 digit number representing a location. I want to insert that location number into a formula that calculates the location's IP address. I then want to use that IP as the basis for a search.

My formula with a location number of 0191 looks like this:

10.(INT(0191/256+170)).(MOD(0191,256)).48)

The resulting IP address is 10.170.191.48

I then hope to use the IP is the following search:

index="winradius" nps_nasIP=10.170.191.48

So I think I would use EVAL as follows:

index="winradius" (eval nps_nasIP=10.(INT(0191/256+170)).(MOD(0191,256)).48)

But this doesn't work.
No error message... just no results are returned.
Not sure how to fix or even troubleshoot this.

Tags (1)
0 Karma

ziegfried
Influencer

You could do this using a subsearch:

index="winradius" [ | stats count | eval nps_nasIP="10." . tostring(floor(tonumber("0191")/256+170)) . "." . tostring(tonumber("0191")%256) . ".48" | return nps_nasIP ]

ziegfried
Influencer

Yes, it's possible. You should take a look at the SideviewUtils app and try to do that using customBahavior on form elements.

http://splunk-base.splunk.com/apps/36405/sideview-utils

0 Karma

mikefoti
Communicator

Thanks.
Can you tell me if, rather they trying to evaluate the formula within the search string, I can insert some code into the form... so that when the user enters 0191, the form calls a script to apply the formula and then inserts he result to the search?

0 Karma

ziegfried
Influencer

it should work, at least on 4.3. The subsearch creates an additional condition for the outer search nps_nasIP="10.170.191.48".

The dot characeter . is used for string concatenation.

There's no INT and MOD function for Splunk's eval command so I changed them to INT ==> floor(tonumber(X)) and MOD ==> X%Y

Here's a list of functions you can use with the eval command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

0 Karma

landen99
Motivator

or just round(x)

0 Karma

mikefoti
Communicator

A couple of things....
1 - thanks for the very quick reply!
2 - unfortunately it doesn't work
3 - what does this string do . "." .
4 - in my formula INT and MOD are mathematical functions so I would not expect replacing the function names with "tonumber" to return the expected result

INT means "round the result to nearest whole number"
MOD(191/256) means "tell me the remainder if 191 is devided by 265"

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...