 Download topic as PDF

# eval command examples

The following are examples for using the SPL2 `eval` command. To learn more about the `eval` command, see How the eval command works.

Many of these examples use the evaluation functions. See Eval functions Quick Reference.

## 1. Create a new field that contains the result of a calculation

Create a new field called `speed` in each event. Calculate the speed by dividing the values in the `distance` field by the values in the `time` field.

`... | eval speed=distance/time`

## 2. Use the if function to analyze field values

Create a new field called `error` in each event. Using the `if` function, set the value in the `error` field to OK if the `status` value is 200. Otherwise set the `error` field value to Problem.

`... | eval error = if(status == 200, "OK", "Problem")`

## 3. Convert values to lowercase

Create a new field in each event called `lowuser`. Using the `lower` function, populate the field with the lowercase version of the values in the `username` field.

`... | eval lowuser = lower(username)`

## 4. Specify field names that contain dashes or other characters

When a field name contains anything other than a-z, A-Z, 0-9, or the underscore ( _ ) character, you must enclose the name in single quotation marks. This includes the wildcard ( * ) character.

This example shows how to specify a field name that includes a dash. The `lower` function is used to populate the `lowuser` field with the lowercase version of the values in the `user-name` field.

`... | eval lowuser = lower('user-name')`

## 5. Calculate the sum of the areas of two circles

This example uses the `pi` and `pow` functions to calculate the area of two circles. A new field called `sum_of_areas` is created to store the sum of the areas of the two circles.

`... | eval sum_of_areas = pi() * pow(radius_a, 2) + pi() * pow(radius_b, 2)`

## 6. Return a string value based on the value of a field

This example uses the `case` function to evaluate the value of the HTTP error codes in the `error` field. Based on the HTTP error codes, a text interpretation of the HTTP error codes is stored in a new field called `error_msg`. .

`... | eval error_msg = case(error == 404, "Not found", error == 500, "Internal Server Error", error == 200, "OK")`

## 7. Concatenate values from two fields

Use the plus ( + ) sign to concatenate the values in `first_name` field with the values in the `last_name` field. Use quotation marks to insert a space character between the two names. When concatenating, the values are read as strings, regardless of the actual value.

`... | eval full_name = first_name+" "+last_name`

The concatenation operator accepts both strings and numbers. Numbers are concatenated as strings and produces a string.

## 8. Separate multiple eval operations with a comma

You can specify multiple eval operations by using a comma to separate the operations. In the following search the `full_name` evaluation uses the plus ( + ) sign to concatenate the values in the `last_name` field with the values in the `first_name` field. In this example, there is a comma and space between the `last_name` field and the `first_name` field. The `low_name` evaluation uses the `lower` function to convert the `full_name` evaluation into lowercase.

`... | eval full_name = last_name+", "+first_name, low_name = lower(full_name)`

## 9. Convert a numeric field value to a string and include commas in the output

Convert a numeric field value to a string. Specify that the string value display with commas. In this example replaces the values in an existing field `x` instead of creating a new field for the converted values. If the original value of x is 1000000, this search returns x as 1,000,000.

`... | eval x=tostring(x, "commas")`

## 10. Include a currency symbol when you convert a numeric field value to a string

Using the previous example, you can include a currency symbol at the beginning of the string. Instead of returning x as 1,000,000, the search returns x as \$1,000,000.

`... | eval x="\$"+tostring(x, "commas")`

eval command
eval command overview
eval command syntax details
eval command usage