Splunk Search

Converting from KB to GB

carlyleadmin
Contributor

Hi All,

i have search that brings data from C and D Drives and results are in KB so i want to convert those fields to GB.

index="main" host="hc1xrds01" Name="C:" OR Name="D:" FreeSpace |eval FreeSpace = round((FreeSpace/1024/1024/1024), 2)

alt text

I still have fields after the conversion in kbs.and even after eval i get another "FreeSpace" field with GB the other FreeSpace taht is highligted is still in KB.how do i change all that to GB?not just the FreeSpace,size and Raw as well which i believe is the top value.

do i have to change the way i get the data?

Thanks Alot

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

Hey
What you have written is correct
Evaluation functions does not change your raw data.It just creates a new field which you can use it further for analysis.

index="main" host="hc1xrds01" Name="C:" OR Name="D:" FreeSpace |eval FreeSpace_in_GB = round((FreeSpace/1024/1024/1024), 2)

FreeSpace_in_GB is the new field created by this search. Use this field for your analysis and not the one which you see FreeSpace.

Let me know if it helps you!

View solution in original post

0 Karma

carlyleadmin
Contributor

That worked thanks.so i wanto make a dashboard from these results but i am having hard time .when i select visualization the data it shows is cropped and not showing all the drives.can you help me with that?if i need to create another thread for it,i can do it.Thanks for all the help

index="main" host="hc1aptr3sv" Name="C:" OR Name="D:" FreeSpace | eval FreeSpace_in_GB = round((FreeSpace/1024/1024/1024), 2)|eval Size_in_GB = round((Size/1024/1024/1024),2)|table host,Name,Size_in_GB,FreeSpace_in_GB| dedup Namealt text

0 Karma

mayurr98
Super Champion

Hey
What you have written is correct
Evaluation functions does not change your raw data.It just creates a new field which you can use it further for analysis.

index="main" host="hc1xrds01" Name="C:" OR Name="D:" FreeSpace |eval FreeSpace_in_GB = round((FreeSpace/1024/1024/1024), 2)

FreeSpace_in_GB is the new field created by this search. Use this field for your analysis and not the one which you see FreeSpace.

Let me know if it helps you!

0 Karma

pradeepkumarg
Influencer

Your eval statement creates a new search time field. The raw data is not altered. What you see on the top is your actual raw data. To avoid confusion, name your new field different

|eval FreeSpace_GB = round((FreeSpace/1024/1024/1024)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...