Eval type error on subseach

jarrodrobins — Mon, 07 Mar 2011 09:10:21 GMT

Hi all, I'm having a few issues with using a subsearch within an eval statement.

index="capacityanalysisindex01" 
| timechart span=1d count by eventtype 
| stats avg(*) 
| eval ratio=(eventtype / ([ search index="capacityanalysisindex01" 
                                      tag::eventtype="EVENTS_PURCHASE_ALL" 
                              | stats count ]))

Running this, I receive the error:

Error in 'eval' command: Typechecking failed. '/' only takes numbers.

I'd have thought that the output of the subsearch would have been a number? If I replace it with an integer, eg, 2, the query works fine (though obviously the results are incorrect), and running the subsearch on its own produces the appropriate output; I just can't link them together.

Essentially what I'm TRYING to do is to: 1. Count up the different event types over a day. 2. Compute the average of each eventtype across each of the days. 3. Divide the averages by the total number of purchase events.

Is there a simple fix to this, or is there a better way of producing the desired results?

Thanks

Re: Eval type error on subseach

sideview — Mon, 07 Mar 2011 11:51:52 GMT

The output of the subsearch is actually count=17, not just the 17. This is because subsearches are made primarily to output searchterms into other searches.

You're not out of luck though, and you dont even have to break out the format command. Subsearches have special behavior where a) if there's only a single field and b) it's called query or search, then it will output only the value. so tack on an

| rename count as search

topic Eval type error on subseach in Splunk Search

Eval type error on subseach

Re: Eval type error on subseach