Skip to content

Splunk Search Command Series: eval (Part Three)


In our last blog, part one of the eval command series, we covered the basics of using eval as well as a few functions of the command. In part two, we covered comparisons, using if/case, and using lower/upper. After so much reading, I am sure you’ve done plenty of exploring on the eval command, so I’ll try to keep this last entry brief.  In part 3 of the eval command series, we’ll explore some miscellaneous functions of eval…



Lower will take all the values from a field and make them lowercase

Syntax: |eval field = lower(field)   


Upper will do the same as lower but all uppercase 

Syntax: |eval field = upper(field) 


Typeof will create a field that will tell you the data type of the field.

Syntax: |eval type = typeof(field) 

Example: string, number 


Round will take a numeric value and round it to the nearest defined decimal place 

Syntax | eval field = round(field, decimal place) 

Example – round(4.56282,2) = 4.56 


This will take a field that has multiple values separated by a space and add a delimiter making it a single value (think opposite of makemv) 

Syntax: |eval field = (field,string) 

|eval field = mvjoin(field, “,”) 

Output = 1,2,3,4,5 

Example: Field – number = 1 2 3 4 5 

That is going to wrap up our eval command series. All in all, eval is a very powerful command with endless use cases and functions. If you have the opportunity, I want to implore you to play around with the different functions and see what you can accomplish.  Thanks for tuning in!

Ask the Experts

Our Splunk Search Command Series is created by our Expertise on Demand (EOD) experts. Every day, our team of Splunk certified professionals works with customers through Splunk troubleshooting support, including Splunk search command best practice. If you’re interested in learning more about our EOD service or chat with our team of experts, fill out the form below!