For example, in each log, I have start_date and end_date, they both together become eval length = ( end_date - start_date ).
So I need my query to be like:
index=test lenght=??/??/???? DD/MM/YYYY | timechart count by logs
Is there a way I can create this dinamic field to be a fixed eval command for splunk? How do I do this?
Thanks in advance!
There are a couple of ways to handle this. If you want this length
field to be created without having to perform an eval
statement in your search, you can add the eval
statement to your props.conf
file. Once it's in there, Splunk will automatically eval that field at search time when it extracts the rest of your fields. Add a statement like this to the appropriate props.conf
stanza(s):
EVAL-length = end_date - start_date
Or, if you only want to filter on the length
field after you've eval'd it in a search, just add a | search
statement onto the end of your search. This will filter your search results down by whatever your search string is:
index=test rest of search terms | eval length=end_date-start_date | search length > foo
There are a couple of ways to handle this. If you want this length
field to be created without having to perform an eval
statement in your search, you can add the eval
statement to your props.conf
file. Once it's in there, Splunk will automatically eval that field at search time when it extracts the rest of your fields. Add a statement like this to the appropriate props.conf
stanza(s):
EVAL-length = end_date - start_date
Or, if you only want to filter on the length
field after you've eval'd it in a search, just add a | search
statement onto the end of your search. This will filter your search results down by whatever your search string is:
index=test rest of search terms | eval length=end_date-start_date | search length > foo
There might be a dynamic eval for a string as well, for example eval channel = (log_a + log_b + "channel")