Splunk > Calculated Fields [Dodge monotonous tasks]
These are the ones(newly created field) which are added to the events at search time and are generated by the calculation of one or more field values that are already present in the events. This is a sort of shortcut to perform repetitive eval calculations.
Where to create one??
Settings => Fields => Calculated Fields
Few things to remember while creating a calculated field:
- Make sure the "Destination app" is selected appropriately (to limit the scope of the calculated field).
- It can be applied to either source or sourcetype or host but make sure * is not used instead, specify a value over there.
- Give a unique name, this would be the name of the newly created field (after the calculations are made).
- Eval statement, make sure to specify just the part where calculations are happening i.e. if you are looking for changing seconds to milliseconds instead of writing all this "| eval RT_MilliSecs = round((RT * 1000),3)" just type in "round((RT * 1000),3)".
Once all the values are entered appropriately just Save, it will create a new calculated field with the name as APPLY_TO::NAMED : EVAL-NAME
And instead of writing the whole chunk of SPL / EVAL statement:
Once we have the calculated field in place, just type in below much smaller SPL:
=> "source::FE-Logs : EVAL-Secs to MilliSecs"
#Splunk #StudySplunk #Happy #Learning #Tips #LearningNeverStops #Education #EdTech #Calculated #Fields