I am using eval foo = mvcount(split(field,"")) to count the number of characters in a field at search time. Is there a place to put such a statement so that the field foo gets created for all events that contain that field?
Thanks
I believe that you want to take a look at 'calculated fields', which lets you make this 'permanent' in a config file. So no need to put it as part of the search.
http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/definecalcfields
http://docs.splunk.com/Documentation/Splunk/5.0.3/admin/Propsconf
EVAL-<fieldname> = <eval statement>
* Use this to automatically run the <eval statement> and assign the
value of the output to <fieldname>. This feature is referred to as 'calculated fields'.
* When multiple EVAL-* statements are specified, they behave as if
they are run in parallel, rather than in any particular sequence.
This means that if you have e.g. EVAL-x=y*2, EVAL-y=100, x will be
assigned the original value of y * 2, not the value of y after it is set to 100.
* All field calculations will done after field aliasing but before lookups. This
means you can lookup based on the value of a calculated field
Hope this helps,
K
I believe that you want to take a look at 'calculated fields', which lets you make this 'permanent' in a config file. So no need to put it as part of the search.
http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/definecalcfields
http://docs.splunk.com/Documentation/Splunk/5.0.3/admin/Propsconf
EVAL-<fieldname> = <eval statement>
* Use this to automatically run the <eval statement> and assign the
value of the output to <fieldname>. This feature is referred to as 'calculated fields'.
* When multiple EVAL-* statements are specified, they behave as if
they are run in parallel, rather than in any particular sequence.
This means that if you have e.g. EVAL-x=y*2, EVAL-y=100, x will be
assigned the original value of y * 2, not the value of y after it is set to 100.
* All field calculations will done after field aliasing but before lookups. This
means you can lookup based on the value of a calculated field
Hope this helps,
K
I was not. Thanks for bring it up. Will change it since it is more simple to use and produces the same results. Thanks again.
You are aware of the len(x)
function for eval
?
http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/CommonEvalFunctions
/k
Perfect. Thank you.