topic Why is division via EVAL is not working? in Splunk Search

Why is division via EVAL is not working?

chiennylin — Wed, 06 Nov 2019 17:29:52 GMT

i tried to get the number of records over time

| rex "Time taken to process(?[^\_]+)records(?[^ms]+)"
| eval aveDuration =recDuration/recNum
| table recNum recDuration aveDuration _raw

but, this is not returning the aveDuration even if i use the simple eval =recDuration/recNum
my rex is correct, and i even put in convert to num but, still not working.

HELP.

thanks

Re: Why is division via EVAL is not working?

marycordova — Wed, 06 Nov 2019 19:33:19 GMT

I don't think the regex is correct, it looks like it might be capturing leading whitespace, try Time\s+taken\s+to\s+process\s+(?<recNum>\d+)\s+records\s+(?<recDuration>\d+)ms and see if it helps.

Also, this might be overkill, but I like to be explicit in my SPL so I would do the following in the eval | eval aveDuration=('recDuration'/'recNum')

Re: Why is division via EVAL is not working?

mayurr98 — Wed, 06 Nov 2019 19:34:12 GMT

try this :

| rex "Time taken to process\s+(?<recNum>\d+)\s+records\s+(?<recDuration>\d+)" 
| eval aveDuration=recDuration/recNum 
| table recNum recDuration aveDuration _raw

Re: Why is division via EVAL is not working?

woodcock — Wed, 06 Nov 2019 22:12:38 GMT

Try this:

... | rex "Time taken to process(?[<recNum>\d+)\s*records\s*(?<recDuration>\d+)"
| eval aveDuration = recDuration / recNum
| table recNum recDuration aveDuration _raw

Re: Why is division via EVAL is not working?

chiennylin — Thu, 07 Nov 2019 16:29:47 GMT

Thanks! this helps!
this is now working. will take note on the whitespace for my rex moving forward.