Splunk Search

Need to summarize fields that not always have a value

detlefschneide1
New Member

In my log (OS X System Log) I collect as transactions the time machine backup data.
I need to summarize the amount of backup that in the log is either listed as KB, MB or GB.

I created three rex, that fill me three fields with the amount of KB, MB and KB.

Now, I try to calculate these three field into a summary fields with

eval TM_Amount_Summary=TM_Amount_K/1024+TM_Amount_M+TM_Amount_G*1024

This works, as long as all three fields contain a value. Though, if for instance TM_Amount_G was not found in a particular transaction, the resulting TM_Amount_Summary remains empty as well.

The eval should work if one or two of the three fields would be empty. How can this be solved?

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could replace every field with coalesce(field, 0) to get around null fields in maths.

View solution in original post

detlefschneide1
New Member

Found an additional way myself too:

eval TM_Amount_Sum=if(isnotnull(TM_Amount_K),TM_Amount_K/1024,"") | eval TM_Amount_Sum=if(isnotnull(TM_Amount_M),TM_Amount_Sum+TM_Amount_M,TM_Amount_Sum) | eval TM_Amount_Sum=if(isnotnull(TM_Amount_G),TM_Amount_Sum+TM_Amount_G*1024,TM_Amount_Sum)

It seems like a field can be overwritten by itself plus a calculation.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could replace every field with coalesce(field, 0) to get around null fields in maths.

gkanapathy
Splunk Employee
Splunk Employee

This is actually the purpose of the coalesce() function, and it's probably a bit easier to read as well.

detlefschneide1
New Member

Found an additional way myself:

eval TM_Amount_Sum=if(isnotnull(TM_Amount_K),TM_Amount_K/1024,"") | eval TM_Amount_Sum=if(isnotnull(TM_Amount_M),TM_Amount_Sum+TM_Amount_M,TM_Amount_Sum) | eval TM_Amount_Sum=if(isnotnull(TM_Amount_G),TM_Amount_Sum+TM_Amount_G*1024,TM_Amount_Sum)

It seems like a field can be overwritten by itself plus a calculation.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...