Splunk® Enterprise

Knowledge Manager Manual

Download manual as PDF

Download topic as PDF

About calculated fields

Calculated fields are fields added to events at search time that perform calculations with the values of two or more fields already present in those events. Use calculated fields as a shortcut for performing repetitive, long, or complex transformations using the eval command.

The eval command enables you to write an expression that uses extracted fields and creates a new field that takes the value that is the result of that expression's evaluation. For more information, see eval.

Eval expressions can be complex. If you need to use a long and complex eval expression on a regular basis, retyping the expression accurately can be tedious.

Calculated fields enable you to define fields with eval expressions. When writing a search, you can cut out the eval expression and reference the field like any other extracted field. The fields are extracted at search time and added to events that include the fields in the eval expressions.

You can create calculated fields in Splunk Web and in props.conf. For information on creating calculated fields in Splunk Web, see Create calculated fields with Splunk Web. For information on creating calculated fields with props.conf, see Configure calculated fields with props.conf.

Calculated fields and the search-time operations sequence


Search-time operations order

Calculated fields come fifth in the search-time operations sequence, after field aliasing but before lookups.


All EVAL-<fieldname> configurations within a single props.conf stanza are processed in parallel, rather than in any particular sequence. This means you cannot "chain" calculated field expressions, where the evaluation of one calculated field is used in the expression for another calculated field.

Calculated fields can reference all types of field extractions and field aliasing, but they cannot reference lookups, event types, or tags.

For more information


Preventing overrides of existing fields

If a calculated field has the same name as a field that has been extracted by normal means, the calculated field will override the extracted field, even if the eval statement evaluates to null. You can cancel this override with the coalesce function for eval in conjunction with the eval expression. Coalesce takes an arbitrary number of arguments and returns the first value that is not null.





For more information about coalesce and other eval functions, see evaluation functions in the Search Reference.

Calculated fields independence

When Splunk software evaluates calculated fields, it evaluates each expression as if it were independent of all other fields. You cannot chain calculated field expressions, where the evaluation of one calculated field is used in the expression for another calculated field.

In the following example, for any individual event, the value of x is equivalent to the value of calculated field y because the two calculations are carried out independently of each other. Both expressions use the original value of x when they calculate x*2.

EVAL-x = x * 2
EVAL-y = x * 2


Another example which involves the extracted field response_time. When it is first extracted, the value of response_time is expressed in milliseconds. Here are two calculated fields that make use of response_time in different ways.

EVAL-response_time =  response_time/1000
EVAL-bitrate = bytes*1000/response_time

In this example, two things are happening with the access_common sourcetype.

  • The second EVAL calculates a new field called bitrate for all sourcetype=access_common events. It is expressed in terms of bytes per second. Bytes is another extracted field.


Last modified on 23 May, 2017
Configure extractions of multivalue fields with fields.conf
Create calculated fields with Splunk Web


Was this documentation topic helpful?





0 out of 1000 Characters