Splunk Search

Use | eval to sum float numbers

maurelio79
Communicator

Hi, i have 2 fields and they are float numbers, for example 2,7 and 0,6.
I need to create a field that is the sum of these 2 fields, but if i use

| eval toal=field_1+field_2

The result is a concatenate string.

I tried also convert num but 2 fields become 2 and 06 then the sum is 8.

Could you help me?

Thanks

Tags (4)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi maurelio79,

looks like the , is the problem, because this will fail

index=_internal | head 1 | eval foo="2,6" | eval bar="3,5" | eval myResult=foo+bar | table myResult

but this will work

index=_internal | head 1 | eval foo="2.6" | eval bar="3.5" | eval myResult=foo+bar | table myResult

any way to replace the , with a dot . maybe by using some regex in SED mode?

Based on the above run everywhere example you can do something like this:

index=_internal | head 1 | eval foo="2,6" | eval bar="3,5" | rex field=foo mode=sed "s/,/./g" | rex field=bar mode=sed "s/,/./g" | eval myResult=foo+bar | table myResult

If this fits your needs you can then set it up to be done automatically, just follow the docs example here.
Or if possible, change the event source to have the numbers logged like this 2.5

hope this helps ...

cheers, MuS

View solution in original post

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi maurelio79,

looks like the , is the problem, because this will fail

index=_internal | head 1 | eval foo="2,6" | eval bar="3,5" | eval myResult=foo+bar | table myResult

but this will work

index=_internal | head 1 | eval foo="2.6" | eval bar="3.5" | eval myResult=foo+bar | table myResult

any way to replace the , with a dot . maybe by using some regex in SED mode?

Based on the above run everywhere example you can do something like this:

index=_internal | head 1 | eval foo="2,6" | eval bar="3,5" | rex field=foo mode=sed "s/,/./g" | rex field=bar mode=sed "s/,/./g" | eval myResult=foo+bar | table myResult

If this fits your needs you can then set it up to be done automatically, just follow the docs example here.
Or if possible, change the event source to have the numbers logged like this 2.5

hope this helps ...

cheers, MuS

0 Karma

MuS
SplunkTrust
SplunkTrust

see my update 😉

0 Karma

maurelio79
Communicator

Good! Thanks! Values are genereted by a bash script, so i can replace "," with "." using sed. It will works. Thanks very much!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...