# calc search command

This search command provides the users the ability to perform mathematical operations on extracted fields using the calc command.

This topic contains the following information:

For a list of all search commands, see Search commands.

Related topics

## Syntax

`eval eval-field= calc <eval-expression>`

In the preceding syntax, the following definitions apply:

• `eval command triggers the evaluate operation and save the result of calculation.`
• `eval-field is the field to store the result of calculation. The eval-field must be more than one character, and must not be all numbers, all special characters, numbers with special characters or string with special characters. For example, A, X, 10\$, 5#, tom(), 1234, and so on are not allowed.`
• `<eval-expression> the extracted fields to be evaluated with the supported mathematical operators.`
• `calc command triggers the calculation of the <eval-expression>.`

## Supported operators

Arithmetic operators

The `calc` command supports the following arithmetic operators within the `<eval-expression>`:

• +: Adds two numbers. 2 + 2 returns 4.
• -: Subtracts two numbers. 3 - 2 returns 1.
• *: Multiplies two numbers. 5 * 2 returns 10.
• /: Divides two numbers. 10 / 2 returns 5.
• ^: Calculates the result of exponentiation. 2 ^ 11 returns 2048.
• (-) + Unary Minus, Plus (Sign Operators): The - (unary minus) operator negates the value of the operand. The operand can have any arithmetic type.  +3 - (-2) returns 1.
• %: Modulo function returns the remainder of a division between two numbers. 5 % 2 returns 1.

Built-in functions

The calc command supports the following built-in functions within the <eval-expression>:

• abs: Function returns the absolute value of a field or a large fraction of a decimal number. For example, abs(0.8796542) returns 0.88.
• ceil: Function returns the nearest upper integer value. For example, ceil(90/40) returns 3.
• floor: Function returns the nearest lower integer value. For example, floor(173/100) returns 1.
• signum: signum function returns the sign of a real number. For example, signum (-25) returns -1.

## Examples

The following sample data and sample indexed data (displayed on the Search tab) will help you understand the examples of using the calc command.

Example 1: Calculate the memory consumption percentage using division arithmetic operation:
`* | eval Memory_consumption_Percentage = calc ((usedMemory/totalMemory)*100)`

Example 2: Calculates the difference between two numbers using subtraction arithmetic operation:

`COLLECTOR_NAME="upload" | eval diff=calc (num1-num2) | top limit=5 COLLECTOR by HOST`

Example 3: Calculate the absolute value of the given number using the abs () built-in function:

`* | eval output=calc (abs(0.668798090900)) `

output=0.67

Example 4:  Calculate the absolute value of the given number using the abs () built-in function:

`* | eval output=calc (abs(linenum+100)) where linenum = 254`

`output=354`

Example 5:  Calculate the absolute value of the given number using the ceil() built-in function:

`* | eval output=calc (ceil(linenum/100)) where linenum = 173`

`output=2`

Example 6:  Calculate the absolute value of the given number using the floor() built-in function:

`* | eval output=calc (floor(linenum/100)) where linenum = 173`

`output=1`

### Example with multiple fields using calc command

In this example, you use the command to replace an existing field name with a new field name. See sample image to understand how this command functions and to correlate the resulting output:

Example 7:  Find the sign of a real number, change the name of a field, and calculate the difference between the changed field and 100:

Command

`* |  eval  output=calc (signum(+11)) | chgname linenum with Line | eval  total_add=calc (Line-100)`

Result

`output=1 | Line=173 | total_add=73`

Notes:

• After replacing the name of a particular field with a new name, you can perform mathematical operation using new name.

• The eval-field must be more than one character, and must not be all numbers, all special characters, numbers with special characters or string with special characters.  For example, * | eval 10\$=calc(20-10) , * | eval X=calc(20-10), or * | eval tom()=calc(50/10) are not allowed.

• You cannot rename an existing (single) field with multiple names. For example, with an existing field X, you cannot replace X with Y and then replace X with Z in one search string.

Example of an invalid syntax
`... | chgname linenum with Line, linenum with dottedline`
• You cannot rename the default fields HOST, COLLECTOR_NAME, and DATA_PATTERN.

• You cannot use default field names to specify a target field.
• You cannot click a renamed field (or tag) to add it to the Fields section (on the Filters panel) or to your search criteria. However, you can use it in a subsequent search command by adding it to your search criteria.
• When you are chaining a calc search command with either a tabular command or saved search with a custom timestamp, it is not displayed on the TrueSight console. The calc search notification works fine when a saved search is tied to a relative time stamp.
Submitting... Thank you