Spread our blog

Usage of Splunk EVAL Function :  ABS is as follows :

This Function takes the “Numeric Value” as an Input and returns its Absolute Value.

Definition :

              How far a number is from zero : –

“6” is 6 away from zero,
and “−6” is also 6 away from zero.
So the absolute value of 6 is 6,
and the absolute value of −6 is also 6

      So in practice “absolute value” means to remove any 
      negative sign in front of a number, and to think of all
     numbers as positive (or zero).

            Find below the skeleton of the usage of the function “abs” with EVAL : 
                       ….. |  eval New_Field=abs(Existing_Numeric_Field)
| head 5 
| eval New_Field=-10
| eval Result=abs(New_Field)
| table New_Field,Result
Result :
New_Field Result
-10 10
-10 10
-10 10
-10 10
-10 10
Explanation :
            In the Query , we are only taking the first 5
            rows that’s why only 5 rows appear with the
            absolute value of a New_Field=-10 , i.e., 10
            ( Positive Number )
Now you can effectively utilize “abs” function with “eval” command to meet your
requirement !!
Hope you are now comfortable in : Usage of Splunk EVAL Function :  ABS

What’s your Reaction?

Spread our blog
Previous articleUsage of Splunk commands : ACCUM
Next articleUsage of Splunk EVAL Function : CASE
Passionate content developer dedicated to producing result-oriented content, a specialist in technical and marketing niche writing!! Splunk Geek is a professional content writer with 6 years of experience and has been working for businesses of all types and sizes. It believes in offering insightful, educational, and valuable content and it's work reflects that.



Please enter your comment!
Please enter your name here