Splunk Search Command Series: eval (Part One)

 

Where to begin with Splunk eval search command… in its simplest form, eval command can calculate an expression and then applies the value to a destination field. Although, that can be easier said than done. That’s why we’ve broken down the eval command into a three-part series. In part one, we’ll cover the basics of eval.

Eval command is an incredibly robust and one of the most commonly used commands. However, you probably don’t know all the possibilities eval is capable of performing. Before we jump right in, let’s take a quick look at the syntax:

|eval <field> = <expression>

Super vague, right? Exactly. Eval has many different functions that can be performed such as:

  • Mathematical
  • Comparison
  • Conversion
  • Multivalue
  • Date and Time
  • Text
  • Informational

The list goes on. Each of the above types of functions has its own list of different arguments-based functions, to list and describe how each one work would result in a novel. But today, I want to start with some basic eval commands.

How to Use eval

When we call a field into the eval command, we either create or manipulate that field for example:

|eval x = 2

If “x” was not an already listed field in our data, then I have now created a new field and have given that field the value of 2. If “x” is a field within our data, then I have overwritten all the fields so that now x is only 2. This is the simplest way to use eval, list a field and give it a value.

eval In Action

eval with mathematical functions

But, we can do so much more than that. Eval is capable of doing mathematical functions:

|stats count
|eval number = 10
|eval percent = (count/number)*100

By using numeric values established by previous lines in our search, we can calculate percentages.

Math is pretty self-explanatory though, let’s talk about something a bit more relative, like time (pun intended)

Format time values with eval

There a couple of ways we can work with time using eval.

The first is formatting, say we are bringing in a time field but it’s written in epoch time. I don’t know about you, but I can’t read epoch time, I’m not a computer. I can, however, convert it to a readable time format:

|eval time = strftime(<time_field>, “%Y-%m-%d %H:%M:%S”)

We can also strip a time format and convert it to epoch:

|eval time= strptime(<time_field>, “%Y-%m-%d %H:%M:%S”)

I know what you’re thinking, “That’s cool, but what if I need to compare my time values with a static time value to say, I don’t know, filter out events”? Great question, here’s what I like to do.

Compare time values with eval

Using “relative-time” I can create a rolling time window:

|eval month = relative_time(now(), “-1mon”)

This line will return a value that is exactly 1 month from now, the time period can be changed to be a day, a week, 27 days, 4 years, whatever your heart desires. From here we can use a where command to filter our results:

|eval time= strptime(<time_field>, “%Y-%m-%d %H:%M:%S”)
|eval month = relative_time(now(), “-1mon”)
|where time > month

Because both of these time values are in epoch, we can simply find results where time is a higher number than a month, or in even simpler terms, anything younger than 1 month.

That’s going to be about it for this first part on the eval command series. Be on the lookout for more deep dives into the eval command in the coming weeks.

Ask the Experts

Our Splunk Search Command Series is created by our Expertise on Demand (EOD) experts. Every day, our team of Splunk certified professionals works with customers through Splunk troubleshooting support, including Splunk search command best practice. If you’re interested in learning more about our EOD service or chat with our team of experts, fill out the form below!

Author

Start typing and press Enter to search