In subduction zones, deep-focus earthquakes may occur at much greater depths (ranging from 300 up to 700 kilometers). The data is a comma separated ASCII text file that contains magnitude (mag), coordinates (latitude, longitude), region (place), and so forth, for each earthquake recorded.Įarthquakes occurring at a depth of less than 70 km are classified as shallow-focus earthquakes, while those with a focal-depth between 70 and 300 km are commonly termed mid-focus earthquakes. | eval error = if(status = 200, 'OK', 'Problem') Separate events into categories and calculate the count, minimum, maximum for each category This example uses recent earthquake data downloaded from the USGS Earthquakes website. Otherwise set the error field value to Problem. Suppose that you want to create a field called error and set the value in the error field to OK if the status value is 200. The functions are organized into these categories: There are dozens of built-in functions that you can use in the eval expression. | eval velocity=distance/time Using eval functions This example creates a new field called velocity in each event and calculate the velocity by dividing the values in the distance field by the values in the time field. Suppose you want to divide the values in one field by the values in another field. One type of expression you can perform is a mathematical expression, such as multiplication, division, addition, and subtraction. There are many types of expressions you can specify. Most of the time the eval command is used to create a new field in your search results and the values in that new field are the result of an expression. The search processes multiple eval expressions left-to-right and lets you reference previously evaluated fields in subsequent expressions.Įval =. You can chain multiple eval expressions in one search using a comma to separate subsequent expressions. The eval command evaluates mathematical, string, and boolean expressions. If the field name that you specify matches a field name that already exists in the search results, the results of the eval expression overwrite the values in that field.If the field name that you specify does not match a field in the output, a new field is added to the search results.

Source='access_30day.The eval command calculates an expression and puts the resulting value into a search results field. Set status to some simple http error codes source='access_30day.log' | eval error_msg = case(status = 404, 'Not found', status = 500, 'Internal Server Error', status = 200, 'OK') index=perfmon sourcetype=Perfmon* counter=* Value=* | eval = Value Assign to the new field the value of the Value field. In this example, use each value of the field counter to make a new field name.

Use the value of one field as the name for a new field | eval error = if(status = 200, 'OK', 'Problem') Using the if function, set the value in the error field to OK if the status value is 200. Use the if function to analyze field valuesĬreate a field called error in each event. | fieldformat time_since_last = tostring(time_since_last, 'duration') | streamstats current=f global=f window=1 last(_time) as last_ts Homework Server's Time host=homework usr=* | eval timesstamp=strftime(_time, '%I:%M') | table timesstamp usrĪdd a field to each event which is the time between this event and the previous one.

The eval command creates new fields in your events by using existing fields and an arbitrary expression. The stats command calculates statistics based on fields in your events. Difference between eval and stats commands If the field name that you specify matches a field name that already exists in the search results, the results of the eval expression overwrite the values in that field. If the field name that you specify does not match a field in the output, a new field is added to the search results. Use: The eval command calculates an expression and puts the resulting value into a search results field. Splunk Commands Tutorials & Reference:- Commands Category: Filtering Commands: eval

Splunk eval