Formatting and transforming data

In this section, we will look at some commands that can be added to the basic queries that we wrote in the previous section. To use these commands, we can add a pipe symbol and follow it with the new command.

The first command we will look at is the eval command. The eval command is one of the most important formatting commands in Splunk. This command allows us to perform calculations and either change the value of fields or create new fields. The form of the eval command is as follows:

…| eval <field>=<expression>, [<field>=<expression>]

Note that we use the pipe symbol in this search. The left-hand side of the pipe symbol passes results to the eval statement. If the field specified in eval exists, then the value of the field is replaced. If not, Splunk creates a new field. Note that this new field is not persistent – that is, it only exists for the duration of the search. Using eval does not change the...