Implementing Splunk 7, Third Edition - Third Edition

eval

The eval command allows you to use functions to build new fields, much like how you build a formula column in Excel, for example:

sourcetype="impl_splunk_gen" | eval  req_time_seconds=date_second/1000 | stats avg(req_time_seconds)

This creates a new field called req_time_seconds on every event that has a value for date_second. Commands after this statement see the field as if it were part of the original event. The stats command then creates a table of the average value of our newly-created field:

There are a huge number of functions available for use with eval. The simplest way to find the full listing is to search Google for Splunk ...