https://community.splunk.com/t5/Splunk-Search/how-to-perform-calculations-using-eval-command/m-p/460905#M130020 <P>At first, if you use both "stats count" and "stats avg" in the same search, the last expression is going to have no output, because of first one. Try to use eventstats instead.<BR /> And at second thing: I'm not sure that "avg" function will work properly with your double quotes and percent mark(maybe Splunk understands "'4%'" expression as a String, not a number). But anyway, hope, it will help:<BR /> <CODE>| makeresults <BR /> | eval healthvalue="'4%'" <BR /> | eventstats count(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount <BR /> | eventstats avg(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount</CODE></P> Thu, 12 Dec 2019 12:45:12 GMT eduardKiyko 2019-12-12T12:45:12Z https://community.splunk.com/t5/Splunk-Search/how-to-perform-calculations-using-eval-command/m-p/460904#M130019 <P>Hi<BR /> I have error_codes like 4%, 5%, 6% So I want to calculate them by performing<BR /> | stats count(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount <BR /> | stats avg(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount<BR /> Any suggestions?</P> Thu, 12 Dec 2019 12:19:58 GMT https://community.splunk.com/t5/Splunk-Search/how-to-perform-calculations-using-eval-command/m-p/460904#M130019 marisstella 2019-12-12T12:19:58Z https://community.splunk.com/t5/Splunk-Search/how-to-perform-calculations-using-eval-command/m-p/460905#M130020 <P>At first, if you use both "stats count" and "stats avg" in the same search, the last expression is going to have no output, because of first one. Try to use eventstats instead.<BR /> And at second thing: I'm not sure that "avg" function will work properly with your double quotes and percent mark(maybe Splunk understands "'4%'" expression as a String, not a number). But anyway, hope, it will help:<BR /> <CODE>| makeresults <BR /> | eval healthvalue="'4%'" <BR /> | eventstats count(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount <BR /> | eventstats avg(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount</CODE></P> Thu, 12 Dec 2019 12:45:12 GMT https://community.splunk.com/t5/Splunk-Search/how-to-perform-calculations-using-eval-command/m-p/460905#M130020 eduardKiyko 2019-12-12T12:45:12Z https://community.splunk.com/t5/Splunk-Search/how-to-perform-calculations-using-eval-command/m-p/460906#M130021 <P>Thanks for your quick reply... it is not exactly looking only for the values mentioned.. it is looking for all the key values for the field healthvalue... I want to it to look for the values which I have specified only. any one of the other clauses will help like match, like, if or any?</P> Thu, 12 Dec 2019 13:03:37 GMT https://community.splunk.com/t5/Splunk-Search/how-to-perform-calculations-using-eval-command/m-p/460906#M130021 marisstella 2019-12-12T13:03:37Z https://community.splunk.com/t5/Splunk-Search/how-to-perform-calculations-using-eval-command/m-p/460907#M130022 <P>Yes, any type of clause that works with eval according to documentation, will work, but in your case you can use "in" as well.<BR /> For example, this search will show errorcount = 0(as there are no events with healthvalue 4%):<BR /> <CODE>| makeresults <BR /> | eval healthvalue="100%" <BR /> | eventstats count(eval(in(healthvalue, "4%"))) as errorcount</CODE></P> <P>And this one will show errorcount = 1(one event with healthvalue 4%):<BR /> <CODE>| makeresults <BR /> | eval healthvalue="4%" <BR /> | eventstats count(eval(in(healthvalue, "4%"))) as errorcount</CODE></P> Thu, 12 Dec 2019 13:11:41 GMT https://community.splunk.com/t5/Splunk-Search/how-to-perform-calculations-using-eval-command/m-p/460907#M130022 eduardKiyko 2019-12-12T13:11:41Z