Answers for "Wildcards in eval function, to eval unknown fields"
https://answers.splunk.com/answers/100842/wildcards-in-eval-function-to-eval-unknown-fields.html
The latest answers for the question "Wildcards in eval function, to eval unknown fields"Answer by royimad
https://answers.splunk.com/answering/100846/view.html
split it by consecutive spaces, get the total number then sum all of them divided by the total number. Note: Don't count the last field just count the spaces and add two to the total number. this will assume that time in the field1 is as of other fields so 1 in 3.
If your first fields contains other then time then considered to be the sum. In that case you will have 2 sum one for field1 and one for all other fields the equation will be
parity(sum+sum/2*(Total Number of Spaces + 2) +- 1) this will include 0 instead of all and the equation will not be thrown by null but by +1 or -1. This is not very fundamental it's just an equation where null could be the solution of your problem, don't be very optimistic if the solution is 1 or greater then it will be the sum. 1=sum , if your first field is 1 as other then you will not receive null as solution. In this case null doesn't exist my dear.Wed, 28 Aug 2013 08:09:58 GMTroyimad