Scale Command
Overview
Details
Using the scale command, you can scale fields matching a pattern by a fixed scale or by a field from each event. This replaces multiple calls to eval for transforming several fields from one unit to the other, such as byte to Megabyte. Optionally you can specify rounding to any precision and choose between division and multiplication to scale up or down easily.
Examples
... | scale scale=1048576 pattern=byte round=0
Converts fields matching the pattern "byte" to megabyte, rounding to whole MB.
... | scale scale=60 pattern="^[^_]"
Converts every numeric field not starting with an underscore, e.g. _time, from seconds to minutes.
... | scale field=Total pattern="^sum" | scale scale=100 pattern="^sum" round=2 inverse=t
Translates every field starting with "sum" into percentages of Total, rounded to two decimal places.
Examples expressed using the Splunk 6 foreach command
Here's how the examples from above would look like using the foreach command added in Splunk 6:
... | foreach *byte* [eval <<FIELD>> = round(<<FIELD>> / 1048576)]
Matching for "field doesn't start with an underscore" isn't possible with only wildcards, so example 2 still requires the scale command.
... | foreach sum* [eval <<FIELD>> = round(<<FIELD>> / Total * 100, 2)]
Syntax
scale (scale= | field=) pattern= [round=] [inverse=t]
Release Notes
Version 0.2
Added support for scaling by a field.