topic Re: Why do I have to use eval for this search? in Splunk Search

Why do I have to use eval for this search?

adamfrisbee — Mon, 29 Jun 2020 17:04:37 GMT

Hi everyone,

Why does this search return nothing

| stats count(status=200) AS Success

While this search returns what I expect?

| stats count(eval(status=200)) AS success

Re: Why do I have to use eval for this search?

richgalloway — Mon, 29 Jun 2020 17:58:22 GMT

The eval function says the argument to count is an expression rather than a field.

Re: Why do I have to use eval for this search?

anilchaithu — Mon, 29 Jun 2020 18:02:04 GMT

@adamfrisbee

In the first SPL there is no field named "status=200". So it fails.

| stats count(status=200) AS Success

The second one has eval nested in, which is equivalent to create a new filed with status=200. So now the stats count the new field.

| stats count(eval(status=200)) AS success

Hope this helps

Re: Why do I have to use eval for this search?

richgalloway — Mon, 29 Jun 2020 18:18:33 GMT

| stats count(eval(status=200))

does NOT create a new field nor does it assign a value to a field. It merely examines the existing 'status' field in the event and returns 1 (true) if that value is 200 or 0 (zero) (false) if it is something else. The count function then tabulates the eval results.

Note: stats count(eval(status=200)) may yield unexpected results when status<>200. Compare it to stats sum(eval(status=200))

Re: Why do I have to use eval for this search?

adamfrisbee — Mon, 29 Jun 2020 19:47:24 GMT

I thought `eval` always created a new field?

Why does it not in this case?

Re: Why do I have to use eval for this search?

richgalloway — Mon, 29 Jun 2020 20:04:16 GMT

I guess you could say eval works differently within the stats command. Run this query to see for yourself.

| makeresults | eval status=404 | stats count(eval(status=200)) as count, values(status) as status | table count status

You should get "0 404" as the result, showing the eval function had no effect on the status field.