![Implementing Splunk 7(Third Edition)](https://wfqqreader-1252317822.image.myqcloud.com/cover/64/36700064/b_36700064.jpg)
上QQ阅读APP看书,第一时间看更新
eval
The eval command allows you to use functions to build new fields, much like how you build a formula column in Excel, for example:
sourcetype="impl_splunk_gen" | eval
req_time_seconds=date_second/1000 | stats avg(req_time_seconds)
This creates a new field called req_time_seconds on every event that has a value for date_second. Commands after this statement see the field as if it were part of the original event. The stats command then creates a table of the average value of our newly-created field:
![](https://epubservercos.yuewen.com/DFC051/19470395608897106/epubprivate/OEBPS/Images/03bc3b48-8801-434c-b99c-bef9221e723a.png?sign=1739391694-eino9QGP3PqplvknN8DzRFrg0hbtsWwY-0-18e8678b0c869f3a3748ae66e7afece8)
There are a huge number of functions available for use with eval. The simplest way to find the full listing is to search Google for Splunk eval functions. I would suggest bookmarking this page, as you will find yourself referring to it often.