calc search command
This topic contains the following information:
For a list of all search commands, see Search commands.
eval eval-field= calc <eval-expression>
In the preceding syntax, the following definitions apply:
eval command triggers the evaluate operation and save the result of calculation.
eval-field is the field to store the result of calculation. The eval-field must be more than one character, and must not be all numbers, all special characters, numbers with special characters or string with special characters. For example, A, X, 10$, 5#, tom(), 1234, and so on are not allowed.
<eval-expression> the extracted fields to be evaluated with the supported mathematical operators.
calc command triggers the calculation of the <eval-expression>.
calc command supports the following arithmetic operators within the
- +: Adds two numbers. 2 + 2 returns 4.
- -: Subtracts two numbers. 3 - 2 returns 1.
- *: Multiplies two numbers. 5 * 2 returns 10.
- /: Divides two numbers. 10 / 2 returns 5.
- ^: Calculates the result of exponentiation. 2 ^ 11 returns 2048.
- (-) + Unary Minus, Plus (Sign Operators): The - (unary minus) operator negates the value of the operand. The operand can have any arithmetic type. +3 - (-2) returns 1.
- %: Modulo function returns the remainder of a division between two numbers. 5 % 2 returns 1.
The calc command supports the following built-in functions within the <eval-expression>:
- abs: Function returns the absolute value of a field or a large fraction of a decimal number. For example, abs(0.8796542) returns 0.88.
- ceil: Function returns the nearest upper integer value. For example, ceil(90/40) returns 3.
- floor: Function returns the nearest lower integer value. For example, floor(173/100) returns 1.
- signum: signum function returns the sign of a real number. For example, signum (-25) returns -1.
The following sample data and sample indexed data (displayed on the Search tab) will help you understand the examples of using the calc command.
Example 1: Calculate the memory consumption percentage using division arithmetic operation:
* | eval Memory_consumption_Percentage = calc ((usedMemory/totalMemory)*100)
Example 2: Calculates the difference between two numbers using subtraction arithmetic operation:
COLLECTOR_NAME="upload" | eval diff=calc (num1-num2) | top limit=5 COLLECTOR by HOST
Example 3: Calculate the absolute value of the given number using the abs () built-in function:
* | eval output=calc (abs(0.668798090900))
Example 4: Calculate the absolute value of the given number using the abs () built-in function:
* | eval output=calc (abs(linenum+100)) where linenum = 254
Example 5: Calculate the absolute value of the given number using the ceil() built-in function:
* | eval output=calc (ceil(linenum/100)) where linenum = 173
Example 6: Calculate the absolute value of the given number using the floor() built-in function:
* | eval output=calc (floor(linenum/100)) where linenum = 173
Example with multiple fields using calc command
In this example, you use the command to replace an existing field name with a new field name. See sample image to understand how this command functions and to correlate the resulting output:
Example 7: Find the sign of a real number, change the name of a field, and calculate the difference between the changed field and 100:
* | eval output=calc (signum(+11)) | chgname linenum with Line | eval total_add=calc (Line-100)
output=1 | Line=173 | total_add=73
After replacing the name of a particular field with a new name, you can perform mathematical operation using new name.
The eval-field must be more than one character, and must not be all numbers, all special characters, numbers with special characters or string with special characters. For example, * | eval 10$=calc(20-10) , * | eval X=calc(20-10), or * | eval tom()=calc(50/10) are not allowed.
You cannot rename an existing (single) field with multiple names. For example, with an existing field X, you cannot replace X with Y and then replace X with Z in one search string.
Example of an invalid syntax
... | chgname linenum with Line, linenum with dottedline
You cannot rename the default fields HOST, COLLECTOR_NAME, and DATA_PATTERN.
- You cannot use default field names to specify a target field.
- You cannot click a renamed field (or tag) to add it to the Fields section (on the Filters panel) or to your search criteria. However, you can use it in a subsequent search command by adding it to your search criteria.
- When you are chaining a calc search command with either a tabular command or saved search with a custom timestamp, it is not displayed on the TrueSight console. The calc search notification works fine when a saved search is tied to a relative time stamp.