Eval command in splunk LEARNOVITA

Splunk Eval Commands With Examples | Free Guide Tutorial [ OverView ]

Last updated on 02nd Nov 2022, Artciles, Blog

About author

Pradip Mehrotra (Senior Splunk SIEM Engineer )

Pradip Mehrotra is an sr Splunk SIEM Engineer with 7+ years of experience, and he is a specialist in an analytics-driven SIEM tool that collects, analyzes, and correlates high volumes of network and other machine data in real-time.

(5.0) | 18954 Ratings 2249
    • In this article you will learn:
    • 1.What is eval command in a Splunk?
    • 2.What does a eval command do?
    • 3.Ways to Use a eval Command in Splunk.
    • 4.Other eval functions.
    • 5.Conclusion.

What is eval command in a Splunk?

The eval command is a commonly used a command in a Splunk that calculates an expression and applies that value to brand new destination field.The eval command is one of the most powerful and widely used commands. However probably don’t know all the possibilities eval is capable of a performing.


  • Eval Command Syntax
  • |eval <"field"> = <"expression">

What does a eval command do?

Essentially are creating a field in the Splunk where one doesn’t already exist. The primary benefit of an eval command is that it allows to see patterns in a data by putting a data into context. That context is created through different formulas that carry out a specific functions such as:

  • Mathematical functions
  • Comparison functions
  • Conversion functions
  • Multivalue functions
  • Date and Time functions
  • Text functions
  • Informational functions

Each of functions above has its own list of an arguments-based functions but in this guide start with ways to use a some basic eval commands.

Splunk Eval

Ways to Use a eval Command in Splunk:

1. Use a eval command with the mathematical functions:

When call a field into an eval command, either create or manipulate that field for an example:

  • |eval x = 2

If “x” was not an already listed field in a data then have now created a new field and have given that field a value of 2. If “x” is a field within a data then have overwritten all the fields so that now x is a only 2. This is simplest way to use an eval list a field and give it a value.Although it is too simple to list here using eval to finish mathematical functions can be quite helpful when analyzing a lot of the data. can turn values into the percentages and even use a stats command to add additional context to a data.

  • |stats count
  • |eval number = 10
  • |eval percent = (count/number)*100

2. Format time values with an eval command:

There are the couple of ways can work with a time using eval.The first is a formatting. Here’s an example If bringing in a time field but it’s written in an epoch time and can convert it into the readable time format:

  • |eval time = strftime(<"time_field">, “%Y-%m-%d %H:%M:%S”)

The second is a stripping a time format and converting it to an epoch:

  • |eval time= strptime(<"time_field">, “%Y-%m-%d %H:%M:%S”)

3. Compare time values with a eval:

Using “relative-time” can create the rolling time window:

  • |eval month = relative_time(now(), “-1mon”)

This line will return the value that is exactly 1 month from now, the time period can be changed to be day, a week, 27 days, 4 years whatever heart desires. From here can use a where command to filter the results:

  • |eval time= strptime(<"time_field">, “%Y-%m-%d %H:%M:%S”)
  • |eval month = relative_time(now(), “-1mon”)
  • |where time > month

Because both of these time values are in an epoch can simply find results where time is be higher number than a month or in even simpler terms anything more recent than a one month.

4. Use If and Case with eval:

IF and CASE are in a same vein of comparison, however, CASE will allow for a more arguments. Let’s take quick look at these two:

  • |eval test = if(status==200, “Cool Beans”, “No Bueno”)

Using IF:

Here’s breakdown when using a IF need to pass a three arguments:

The condition – this is usually if something equals to some value.

The result – if said field does equal are defined value then the test’s value is an argument.

The else – if said field does NOT equal are defined values then test’s value is an argument.

In this case if status are equals 200, then a text would say “Cool Beans.” If value of status is anything other than a 200 then text reads “No Bueno.”

Eval Functions

Using CASE:

As stated earlier, CASE will allow us to the add more arguments.

  • |eval test = case(status==”2*”, “Cool Beans”, status==”5*”, “Yikes”, status==”4*”, “might be broken”)

As can see can apply a multiple conditions using case to get a more robust list of the descriptions.

5. Use lower/upper with eval:

Sometimes, text formatting in a data can be weird. Splunk says that when can search for a value it doesn’t need to be a case-sensitive but take that with the grain of salt. It’s also not true when comparing values from a various sources.Event Data – ID: 1234AbCD, Lookup – ID: 1234abcd .If trying to use a lookup command and join and get values in the coherent table of information, that’s not going to be happen. Why? Because of two values don’t match. Sure a numbers and letters are the same, but formatting is different. Splunk views that as are a roadblock. Need a quick fix? Here’s one that’s super simple and barely an inconvenience.

  • |eval id = lower/upper(id)

Lower and upper will allow to format a field value to make all the letters each lowercase or uppercase depending on which function can use. Finally make letters in an event data lowercase so that the lookup and indexed data can be communicate correctly.

Other eval functions:

Lower(x): Lower will take all values from a field and make them lowercase


  • |eval field = lower(field)

Upper(X): Upper will do a same as lower but all the uppercase


  • |eval field = upper(field)

Typeof(x): Typeof will create the field that will tell the data type of a field.


  • |eval type = typeof(field)
  • Example: string, number
Round(X,Y): Round will take the numeric value and round it to the nearest explained a decimal place .


  • | eval field = round(field, decimal place)
  • Example – round(4.56282,2) = 4.56
Mvjoin(x,y): This will take the field that has multiple values separated by space and add a delimiter making it single value .


  • |eval field = (field,string)
  • |eval field = mvjoin(field, “,”)
  • Output = 1,2,3,4,5

Eval is the very powerful command in Splunk that gives an insight into a data that just can’t be seen on the surface of monitoring console dashboards. Try out eval command on a next search and explore the possibilities .

Are you looking training with Right Jobs?

Contact Us

Popular Courses