![]() When concatenating, the values are read as strings, regardless of the actual value. Use quotation marks to insert a space character between the two names. Use the plus ( + ) sign to concatenate the values in first_name field with the values in the last_name field. | eval error_msg = case(error = 404, "Not found", error = 500, "Internal Server Error", error = 200, "OK") 7. Based on the HTTP error codes, a text interpretation of the HTTP error codes is stored in a new field called error_msg. This example uses the case function to evaluate the value of the HTTP error codes in the error field. Return a string value based on the value of a field | eval sum_of_areas = pi() * pow(radius_a, 2) + pi() * pow(radius_b, 2) 6. A new field called sum_of_areas is created to store the sum of the areas of the two circles. This example uses the pi and pow functions to calculate the area of two circles. Calculate the sum of the areas of two circles The lower function is used to populate the lowuser field with the lowercase version of the values in the user-name field. This example shows how to specify a field name that includes a dash. ![]() This includes the wildcard ( * ) character. When a field name contains anything other than a-z, A-Z, 0-9, or the underscore ( _ ) character, you must enclose the name in single quotation marks. Specify field names that contain dashes or other characters Using the lower function, populate the field with the lowercase version of the values in the username field. ![]() Convert values to lowercaseĬreate a new field in each event called lowuser. | eval error = if(status = 200, "OK", "Problem") 3. Otherwise set the error field value to Problem. Using the if function, set the value in the error field to OK if the status value is 200. Use the if function to analyze field valuesĬreate a new field called error in each event. Calculate the speed by dividing the values in the distance field by the values in the time field. Create a new field that contains the result of a calculationĬreate a new field called speed in each event. See Quick Reference for SPL2 eval functions.ġ. Many of these examples use the evaluation functions. To learn more about the eval command, see How the eval command works. You can retake the certification exam three times, but a lengthy time period must pass between each attempt.The following are examples for using the SPL2 eval command. There were a lot of questions as there are many topics, so you should definitely review each topic before taking it. It is recommended that you spend ample time understanding these topics if you do not have practical Splunk experience. Here's a link to the certification exam page if that's what you're interested in. You can see a long list of topics on the Fundamentals course page. Note that the exam for this course is NOT the Splunk Certified User course. As long as you pay attention to each section and take good notes you'll do well on this course exam. At the end of the course there is another quick test. ![]() You can retake the quizzes until you get all of the answers right. Throughout the course you'll have quizzes at the end of each section. It took me about 1.5 full work days to go through all of the material, although I recommend taking more time and really reading through all of the documentation if your goal is to understand Splunk fundamentals. Hey the Splunk Fundamentals course is a self-paced course.
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |