Splunk Search

I have 2 fields i.e. Currency and Amount. I want to convert amount with its associated currency into INR format so that I can sum it up and calculate revenue.

mayurr98
Super Champion

Currency Amount
USD 2
INR 3
AED 5
6
8
20
AND SO ON.
suppose 2 has currency USD . 3 has currency INR. 5 has currency USD
I want to convert this values into dafault INR. and then I want to sum all those values.how do I do?

0 Karma

woodcock
Esteemed Legend

Start here:

http://docs.splunk.com/Documentation/Splunk/6.0/Search/Usesearchmacros

Then you need to lookup how to convert between currencies. For Euros to Dollars, your macro would start and end like this (you fill in the middle):

eval INR = case(Currency="INR", Amount,
                Currency="USD", Amount * 67.28,
                             ...
                true(), "ERROR: UNKNOWN CURRENCY!")
0 Karma

woodcock
Esteemed Legend

Build a macro that does this conversion for you and call it like this:

your search here | `YourMacroHere(Currency, Amount)`
0 Karma

mayurr98
Super Champion

what macro query should I put for conversion. I am new to splunk. Can you pls tell me

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...