topic Re: why is eval function not working for calculated field but works when run as a search using two different source type in Splunk Search

why is eval function not working for calculated field but works when run as a search using two different source type

LionelRubdi — Tue, 29 Sep 2020 14:37:13 GMT

My calculated field with the following eval function is not returning values

round(if(svt_due_date=="null",sv_due_date,(svt_due_date - c_isnull_reported_submited_date ))/3600000)

but when I run the eval expression as a search - it does return a value.

.....index=abc| eval cc_resolved_sla_hours=round(if(svt_due_date=="null",sv_due_date,(svt_due_date - c_isnull_reported_submited_date ))/3600000)

I have tried using host, source type as itam* and also the source type. The svt_due_date is from another source type from the same index (the resulting value is calculation from 2 source types from the same index). I have also tried “sourcetype=itam_inc_xml OR sourcetype=itam_sla_xml” in the calculated field which did not work.

Is there something I may be missing or creating the calculated fields incorrectly?

Re: why is eval function not working for calculated field but works when run as a search using two different source type

cmerriman — Tue, 29 Sep 2020 14:37:29 GMT

does svt_due_date actually have a "null" value or is it a blank/null field value? try replacing with isnull(svt_due_date) if it is actually a null value

Re: why is eval function not working for calculated field but works when run as a search using two different source type

LionelRubdi — Wed, 21 Jun 2017 12:43:29 GMT

The field has blank values and date in epoch. This field is from another source type from the same index. The same eval expression works when run as a search but not when run as a calculated field. I doubt I'd calculated can have multiple source types . Can you confirm please ? What other options I have to create a calculated field using multiple source types ? Thanks in advance

Re: why is eval function not working for calculated field but works when run as a search using two different source type

thirumalreddyb — Wed, 21 Jun 2017 13:29:34 GMT

You query would work only if all the fields that you are using in the eval expression are under the same sourcetype/source/host based on the stanza that you are using in your props.