topic Re: Why is '"foreach" ingoring some columns in the calculation? in Splunk Search

Why is '"foreach" ingoring some columns in the calculation?

HeinzWaescher — Wed, 22 Mar 2017 11:23:43 GMT

Hi,

I'm trying to calculate the ratio for all columns of a table compared to a specific column. So in the example below, just divide every column by colA. For some reason this does not work for all columns (colD is wrong), do you have any idea why?

When I decide to write the calculated values into new columns instead of replacing them, it works

Thanks in advance

Re: Why is '"foreach" ingoring some columns in the calculation?

cmerriman — Wed, 22 Mar 2017 11:51:18 GMT

seems like it could be a bug to report. it looks like it's taking the replaced colA as the divisor and then multiplying by 100, leaving it with the initial value. I don't know why colB and colC aren't doing it as well, though.

to test, try creating a new column (colADup, or something) and do: |eval colADup=colA|foreach * [eval <<FIELD>>=round('<<FIELD>>'/colADup*100,2)]|fields - colADup

Re: Why is '"foreach" ingoring some columns in the calculation?

HeinzWaescher — Wed, 22 Mar 2017 12:24:47 GMT

Creating a colADup column and using it in foreach works as well. I don't get it 🙂

Re: Why is '"foreach" ingoring some columns in the calculation?

cmerriman — Wed, 22 Mar 2017 12:39:36 GMT

I think it's using the new '100' in colA in your original syntax when calculating colD, I'm just not sure why it doesn't do that for colB or colC.

Re: Why is '"foreach" ingoring some columns in the calculation?

woodcock — Wed, 22 Mar 2017 14:42:01 GMT

Because you have modified colA in the middle of the work: try this:

... | eval _colA = colA | foreach * [eval <<FIELD>> = round('<<FIELD>>'/_colA*100,2)]

Fields that begin with underscores have several peculiarities, in particular these 2:
They are not shown on the 'Statisticstab (except fortime), They are not included in wildcards for fields (which is why you need to do things likeindex=* OR index=*`).

Re: Why is '"foreach" ingoring some columns in the calculation?

helge — Tue, 11 Sep 2018 22:46:49 GMT

That remark about fields whose names begin with underscores not being included in wildcards for fields is a life-saver. Is that documented anywhere?