topic Re: help on eval in Splunk Dev

help on eval

jip31 — Wed, 08 Aug 2018 05:25:36 GMT

hello
In "eval TotalSpace" I need to multiply "Percfree_space" with "FreeSpace" and to add the FreeSpace total to the result and to display
the result of "FreeSpace" and "TotalSpace" in "eval Disk"
I done this but it doesnt works
Could you help me please??

| eval MBfree_space = if(counter="Free Megabytes",Value,null) 

| eval Percfree_space = if(counter="% Free Space",Value,null)  

| eval FreeSpace = round(MBfree_space/1024,2)." MB / "

| eval TotalSpace = round((100-Percfree_space)*(FreeSpace)+(FreeSpace),2))." MB"

| eval Disk = FreeSpace "/" TotalSpace

Re: help on eval

493669 — Wed, 08 Aug 2018 05:32:01 GMT

can you provide some sample having value of field names counter ,value, etc. and expected result

Re: help on eval

jip31 — Wed, 08 Aug 2018 05:56:37 GMT

I dont understand your questions
Free Megabytes give the amount of free disk space in megabytes
% Free Space give the amount of free disk space in %
So in eval disk I need to display for example 300 MB / 400 MB

Re: help on eval

493669 — Wed, 08 Aug 2018 06:05:46 GMT

Try this:

 | eval MBfree_space = if(counter="Free Megabytes",Value,null) 
 | eval Percfree_space = if(counter="% Free Space",Value,null)  
 | eval FreeSpace = round(MBfree_space/1024,2)
 |fillnull
 | eval TotalSpace = round(((100-Percfree_space)*FreeSpace)+FreeSpace,2)
 | eval Disk = FreeSpace."MB". "/". TotalSpace."MB"

Re: help on eval

jip31 — Wed, 08 Aug 2018 06:15:30 GMT

it doesnt works
it calculate nothing because i have 0MB/0.00MB (also in other columns)
when i delete |fillnull i have nothing

Re: help on eval

poete — Wed, 08 Aug 2018 06:31:57 GMT

Hello @jip31,

what are you trying to do with this line : | eval Disk = FreeSpace "/" TotalSpace

It does not concatenate and does not perform an operation.

Did you not mean | eval Disk = FreeSpace ."/". TotalSpace ?

Re: help on eval

493669 — Wed, 08 Aug 2018 06:32:46 GMT

thats why I asked to share sample values of fields like counter value and expected result of TotalSpace Disk
like below-

counter                  Value   FreeSpace     TotalSpace               Disk 
Free Megabytes          23          0.02               2.02              0.02MB/2.02MB
% Free Space               30          0                 0.00              0MB/0.00MB

Re: help on eval

jip31 — Tue, 29 Sep 2020 20:53:34 GMT

Nobody for helping me please?
with this i have no results
| eval MBfree_space = if(counter="Free Megabytes",Value,null)
| eval Percfree_space = if(counter="% Free Space",Value,null)

| eval FreeSpace = round(MBfree_space/1024,2)
| eval TotalSpace = round(((100-Percfree_space)*FreeSpace)+FreeSpace,2)
| eval Disk = FreeSpace."MB". "/". TotalSpace."MB"
| stats latest(Disk) as Disk by host

Re: help on eval

Shan — Fri, 10 Aug 2018 09:55:30 GMT

@jip31,

Kindly Provide sample data as displayed by 493669.
So someone can help you ..
Without sample data and your expected result . how can someone help you 🙂 ..

Thanks

Re: help on eval

jip31 — Tue, 29 Sep 2020 20:53:59 GMT

hello
the entire
index="perfmon" sourcetype="perfmon:logicaldisk" instance=c: counter="Free Megabytes" OR counter="% Free Space"| eval MBfree_space = if(counter="Free Megabytes",Value,null)
| eval Percfree_space = if(counter="% Free Space",Value,null)

| eval FreeSpace = round(MBfree_space/1024,2)
| eval TotalSpace = round(((100-Percfree_space)*FreeSpace)+FreeSpace,2)
| eval Disk = FreeSpace."MB". "/". TotalSpace."MB"| stats latest(Disk) as Disk

I need result with this format : 0.00MB/0.00MB
First the free space in MB and after the toatl space in MB
thanks a lot

Re: help on eval

DalJeanis — Sat, 11 Aug 2018 05:09:41 GMT

The problem appears to be that you have two different kinds of records, each a different counter, and so one of the numbers on each record will always be null. Multiplying anything times null will always be null. if you use fillnull, you will multiply by zero and get zero.

I'm going to guess that these are Perfmon metric records on Windows. I guessed that by doing a google search for the key words and field names you are looking for... site:answers.splunk.com free megabytes counter value If you just search for what you are trying to do, you will find multiple examples.

This one is somewhat similar to your issue, and has an excellent answer by @cusello, and other quick answers by @woodcock and @somesoni2, two of our heavy hitters.

https://answers.splunk.com/answers/512937/how-to-combine-2-searches-to-get-show-values-and-p.html

Here's another...

https://answers.splunk.com/answers/454999/how-to-develop-a-search-to-find-free-disk-space-us.html

And here's one I just have to include because the accepted answer is code written by awesome Splunk guy @jkat54, and it is code which clearly embarrassed him to post, so I just have to call everybody's attention to it...

https://answers.splunk.com/answers/439855/how-to-calculate-total-disk-size-when-using-freedi.html

There's another version in a comment underneath his which refactors jkat's code from a join to stats, which is the preferred method, but if either one meets your use case, use it.

Re: help on eval

woodcock — Sat, 11 Aug 2018 05:41:28 GMT

It is likely that the problem is that each metric is in a different event. If so, the separate events must be merged before the fields/values can be used together. In any case, until you show us EXACTLY what each event is, it is unlikely that anyone will be able to help.