Splunk Search

I have 2 fields i.e. Currency and Amount. I want to convert amount with its associated currency into INR format so that I can sum it up and calculate revenue.

mayurr98
Super Champion

Currency Amount
USD 2
INR 3
AED 5
6
8
20
AND SO ON.
suppose 2 has currency USD . 3 has currency INR. 5 has currency USD
I want to convert this values into dafault INR. and then I want to sum all those values.how do I do?

0 Karma

woodcock
Esteemed Legend

Start here:

http://docs.splunk.com/Documentation/Splunk/6.0/Search/Usesearchmacros

Then you need to lookup how to convert between currencies. For Euros to Dollars, your macro would start and end like this (you fill in the middle):

eval INR = case(Currency="INR", Amount,
                Currency="USD", Amount * 67.28,
                             ...
                true(), "ERROR: UNKNOWN CURRENCY!")
0 Karma

woodcock
Esteemed Legend

Build a macro that does this conversion for you and call it like this:

your search here | `YourMacroHere(Currency, Amount)`
0 Karma

mayurr98
Super Champion

what macro query should I put for conversion. I am new to splunk. Can you pls tell me

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...