Splunk® Cloud Services

SPL2 Search Reference

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Overview of SPL2 eval functions

Use evaluation functions to evaluate an expression, based on your events, and return a result.

Quick reference

See the Eval functions Quick Reference for a list of the supported evaluation functions, along with a brief description and the syntax for each function.

Commands that use eval functions

You can use evaluation functions with the following commands:

  • In the WHERE and SELECT clauses of the from command
  • With the eval and where commands
  • As part of evaluation expressions with other commands.

Evaluation expressions are case-sensitive.

Using functions

  • All functions that accept strings can accept either a literal string or any field. 
  • All functions that accept numbers can accept either literal numbers or any numeric field.

Specifying literal strings

For most evaluation functions, when a string argument is expected you can specify either an literal string or a field. The literal string must be enclosed in double quotation marks. For example, you have a field called name which contains the names of your servers. You want to append the literal string server at the end of the name. You would specify this: name + "server".​

Nested functions

You can specify a function as an argument to another function.

In the following example, the cidrmatch function is used as the first argument in the if function.

... | eval isLocal=if(cidrmatch("",ip), "local", "not local")

The following example uses the in function as the first parameter for the if function.

... | eval error=if(in(status, "error", "failure", "severe"), "true", "false")


The following tables list the basic mathematical operations that you can use with the evaluation functions. For these operations to work, the values need to be valid for the type of operation. For example, with the exception of addition, arithmetic operations might not produce valid results if the values are not numerical. When concatenating values, Splunk software reads the values as strings, regardless of the value.

Arithmetic operators

Operators Action Description
+ Addition Accepts two numbers and produces a number.
- Subtraction Accepts two numbers and produces a number.
* Multiplication Accepts two numbers and produces a number.
/ Division Accepts two numbers and produces a number.
% Modulo Accepts two numbers and produces a number.

Concatenation operator

Operator Action Description
+ Concatenation Accepts both strings and numbers. Numbers are concatenated as strings. Produces a string.

Boolean operators

Operators Action Description
AND Logical AND operator Accepts two Boolean values and produces a Boolean.
OR Logical OR operator Accepts two Boolean values and produces a Boolean.
NOT Logical NOT operator Accepts one Boolean value and produces the inverse of the value.
XOR Exclusive OR operator Accepts two Boolean values and produces a Boolean.
< Less than Accepts two numbers and produces a Boolean.
> Greater than Accepts two numbers and produces a Boolean.
<= Less than or equal to Accepts two numbers or two strings and produces a Boolean.
>= Greater than or equal to Accepts two numbers and produces a Boolean.
!= Not equal to Accepts two numbers or two strings and produces a Boolean.
= or == Equal to In expressions, the = and == operators are synonymous. These operators compare the value of right side and left side of the expression. Returns 1 (true) if the sides are equal. Returns 0 (false) if the sides are not equal.
LIKE Text pattern matching operator Accepts two strings. For example string LIKE pattern. The pattern operator supports literal text, a percent ( % ) character for a wildcard, and an underscore ( _ ) character for a single character match.

For example, field LIKE "a%b_" matches any string starting with a, followed by anything, followed by b, followed by one character.

Naming function arguments

When you use a function, you can include the names the argument in your search. Naming arguments is optional.

Naming argument is useful to identify the arguments, especially when the function includes optional arguments or arguments that are both the same data type. Naming arguments makes it clear which value applies to each argument.

For example, the syntax for the round function is round(num, precision). The precision argument is optional. When not specified, the default precision is to round to an integer, dropping any digits after the decimal point.

An example of using the round function is this:

... |eval n=round(2.555, 2)

To name the arguments, you would specify this:

... |eval n=round(num:2.555, precision:2)

  • Argument names are separated from argument values by a colon ( : ).
  • If an argument can accept a list of values, you must enclose the list in square brackets ( [ ] ).
  • Named arguments can appear in any order.
  • You can choose to name only some of the arguments. However, named arguments must appear after unnamed arguments.

The following table shows valid and invalid named argument syntax for the round and case functions:

Valid syntax Invalid syntax
Required argument only

... |eval n=round(2.555)

Missing required argument

... |eval n=round(precision:2)

All arguments

... |eval n=round(2.555, 2)

Named required argument

... |eval n=round(num:2.555)

Named all arguments

... |eval n=round(num:2.555, precision:2)

Name arguments in any order

... |eval n=round(precision:2, num:2.555)

Not all arguments need to be named, but named arguments must follow unnamed arguments

... |eval n=round(2.555, precision:2

Named arguments cannot come before unnamed arguments

... |eval n=round(num:2.555, 2)

Multiple values for an argument in square brackets

...eval description=case(conditions: [status=200, "OK", status=400, "BAD"])

See also

eval command overview
where command overview
Overview of SPL2 statistical and charting functions
Overview of SPL2 dataset_functions
Custom eval functions
Last modified on 19 August, 2021
Differences between SPL and SPL2
SPL2 eval functions Quick Reference

This documentation applies to the following versions of Splunk® Cloud Services: current

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters