In SPL2, the concatenation operator is the plus ( + ) sign. The concatenation operator is the plus ( + ) sign The, , ) function in the list of Comparison and Conditional eval functions.ĭifferences between SPL and SPL2 Field names with special character must be in single quotesįield names that contain anything other than a-z, A-Z, 0-9, or the underscore ( _ ) character, must be enclosed in single quotation marks.The AND, OR, and XOR operators accept two Boolean values.Numbers are concatenated in their string represented form. You must include a space on either side of the plus ( + ) operator. The plus ( + ) operator concatenates both strings and number.The subtraction ( - ), multiplication ( * ), division ( / ), and modulus ( % ) operators accept two numbers.The plus ( + ) operator accepts two numbers for addition, or two strings for concatenation.When concatenating values, Splunk software reads the values as strings, regardless of the value. ![]() For example, with the exception of addition, arithmetic operations might not produce valid results if the values are not numerical. For these evaluations to work, the values need to be valid for the type of operation. The following table lists the basic operations you can perform with the eval command. You can use a wide range of functions with the eval command. See Example 2 of the sigfig(X) function examples. If a result returns a long number with more digits than you want to use, you can specify the number of digits to return using the sigfig function. ![]() The limit to precision is 17 significant digits, or -2 53 +1 to 2 53 -1. In those situations precision might be lost on the least significant digits. There are situations where the results of a calculation contain more digits than can be represented by a floating- point number. If you want to return an arbitrary number of digits of precision, use the exact function, as shown the the last calculation in the search. ![]() For example, the following search has different precision for 0.2 in each of the calculations based on the number of zeros following the number 2: The precision of the results can be no greater than the precision of the least-precise input. Results are rounded to a precision appropriate to the precision of the input results. Division by zero results in a null field. The special values for positive and negative infinity are represented in your results as "inf" and "-inf" respectively. If the calculation results in the floating-point special value NaN(Not a Number), it is represented as "nan" in your results. For functions that return a Boolean value, you must specify the function inside the another function, such as the if function, which can accept a Boolean value as an input.ĭuring calculations, numbers are treated as double-precision floating-point numbers, subject to all the usual behaviors of floating point numbers. The eval command cannot accept a Boolean value directly. While you can use these functions with the where or WHERE clause in the from command without issue, the eval command is a different matter. Some evaluation functions return a Boolean value, such as the in or isint functions. If you are using a search as an argument to the eval command and functions, you cannot use a saved search name you must pass a literal search string or a field that contains a literal search string (like the 'search' field extracted from index=_audit events). However you can convert booleans and nulls to strings using the tostring() function, which can be assigned to fields. Numbers and strings can be assigned to fields, while booleans cannot be assigned. For a list of the reserved words, see Reserved words. If you specify a name for a new field, the name can't be a reserved word. ![]() If the field name that you specify matches an existing field name, the values in the existing field are replaced by the results of the eval expression. You can specify a name for a new field or for an existing field. You must specify a field name for the results that are returned from your eval command expression.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |