Implementing Splunk 7(Third Edition)
上QQ阅读APP看书,第一时间看更新

eval

The eval command allows you to use functions to build new fields, much like how you build a formula column in Excel, for example:

sourcetype="impl_splunk_gen" | eval 
req_time_seconds=date_second/1000 | stats avg(req_time_seconds)

This creates a new field called req_time_seconds on every event that has a value for date_second. Commands after this statement see the field as if it were part of the original event. The stats command then creates a table of the average value of our newly-created field:

There are a huge number of functions available for use with eval. The simplest way to find the full listing is to search Google for Splunk eval functions. I would suggest bookmarking this page, as you will find yourself referring to it often.