Splunk Search

splunk eval row with last field

jaxob01
New Member

Hello Splunkers

i requiered eval the last field with current row.

example:

field 1 ...... field2.........field3........................................................................result
1..................1..............(field1+field2)...........................................................field3
3..................4..............(last_field3 + current field1) - current field2) ... current field3
7..................2..............(last_field3 + current field1) - current field2) ... current field3

numeric example

field 1 ...... field2.........field3...........................result
1..................1..............(1+1)...............................2
3..................4..............(2 + 3) - 4) ..................... 1
7..................2..............(1 + 7) - 2) ......................6

thanks!!!

0 Karma

FrankVl
Ultra Champion

I thought I had an idea how to solve this:

| makeresults 
| eval field1 = 1 
| eval field2 = 1 
| eval field3 = field1+field2 
| append [
| makeresults 
| eval field1 = 3 
| eval field2 = 4 
]
| append [
| makeresults 
| eval field1 = 7 
| eval field2 = 2 
]
| fields - _time
| eval field3 = coalesce(field3,field1-field2)
| streamstats window=2 sum(field3) as field3

But it seems streamstats (even though it is configured to write the sum back into field3) takes the original field3 values, rather than those from after streamstats was applied to the previous event.

So not sure how you can do such a 'recursive' eval. Still posting this as it might inspire others to come up with something that does work.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...