Wow, I can't believe this is kicking my butt -- think I need an idiot check... (yes, I know... 😉
I'm trying to do a simple conversion: sizeK=(fileinfo.size/1024) but it's failing. I've done these hundreds of times before, and have it documented in my notes from years ago. Oh, and triple checked it here against multiple examples.
The whole line is simply:
index=suricata event_type=fileinfo| eval sizeK=(fileinfo.size/1024)
It's not creating "sizeK".
When I change to:
| eval sizeK=round(fileinfo.size/1024)
or
| eval sizeK=round(fileinfo.size/1024,2)
I get: "Error in 'eval' command: The arguments to the 'round' function are invalid. "
Even tried:
| eval sizeK=fileinfo.size/1024
Still no workie. Suggestions?
@Michael Try renaming fileinfo.size.
index=suricata event_type=fileinfo| rename fileinfo.size as size |eval sizeK=(size/1024)
Your field name contains special character (dot, even hyphen and spaces will cause this) so when referencing it in expression parts (RHS of eval OR in where clause), you need to include it in single quotes, like this:
index=suricata event_type=fileinfo| eval sizeK=('fileinfo.size'/1024)
Without including it in single quotes, the dot is treated as concatenation operator and it's looking for two fields fileinfo
and size
to concatenate values, and which probably are not available.
@Michael Try renaming fileinfo.size.
index=suricata event_type=fileinfo| rename fileinfo.size as size |eval sizeK=(size/1024)
OMG, that fixed it. That was making me nuts!
That's just silly that it can't handle that fieldname (I even tried "fileinfo.size" and 'fileinfo.size').
Thanks!
@Michael If it has worked for you, please do accept the answer. Thanks!