Splunk Search

converted values not displaying after rex and eval

codedtech
Path Finder

I'm trying to run this eval statement, but the only value that dispalys in the y value.

my index|rex mode=sed field=capacity_gb "s/[^\d\.,]//g"|rex mode=sed field=vmdkused_gb "s/[^\d\.,]//g"|eval x = tonumber(capacity_gb)|eval y = tonumber(vmdkalloc_gb)|eval z = y/x| table x,y,z

X           Y         Z
             Y
0 Karma

venkasplunk
New Member

From ur below statement, it looks like you are using wrong filed for value Y.

You extracted rex mode=sed field=vmdkused_gb , but you are using y = tonumber(vmdkalloc_gb) , it should be y = tonumber(vmdkused_gb) ???

index|rex mode=sed field=capacity_gb "s/[^\d.,]//g"|rex mode=sed field=vmdkused_gb "s/[^\d.,]//g"|eval x = tonumber(capacity_gb)|eval y = tonumber(vmdkalloc_gb)|eval z = y/x| table x,y,z

0 Karma

Vijeta
Influencer

can you share your events and what fields are you trying to parse.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...