topic Re: I am getting the Error in 'eval' command: Type checking failed. '-' only takes numbers, while calculating difference in Splunk Search

I am getting the Error in 'eval' command: Type checking failed. '-' only takes numbers, while calculating difference

dtccsundar — Wed, 30 Jun 2021 11:01:34 GMT

Hi ,

My wish to get the difference between yesterday and todays Pass % and fail % for different sourcetypes .

I have tried as below ,

|append

[search index=x1 sourcetype=y1 OR sourcetype=y2 OR sourcetype=y3 OR sourcetype=y4 OR sourcetype=y5 OR sourcetype=y6 OR sourcetype=y7 earliest=-48h@h latest=-24h@h|chart count over sourcetype by Status|addtotals|eval "yest Pass %"=round((Pass/Total)*100,3) |eval "yest Fail %"=round((Fail/Total)*100,3) |stats count by sourcetype "yest Pass %" "yest Fail %" |rename Total as "Total Scope"|eval repo="yest"]

|eval "Pass % diff"=round("dbyest Pass %"-"yest Pass %")|table "dbyest Pass %" "dbyest Fail %" "yest Pass %" "yest Fail %" "Pass % diff"

When i ran this , i am getting the error "Error in 'eval' command: Type checking failed. '-' only takes numbers."

Please help me in this to get the difference ?

Re: I am getting the Error in 'eval' command: Type checking failed. '-' only takes numbers, while calculating difference

kamlesh_vaghela — Wed, 30 Jun 2021 11:13:13 GMT

@dtccsundar

Can you please change your eval with this?

| eval "Pass % diff"=round('dbyest Pass %'-'yest Pass %')

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: I am getting the Error in 'eval' command: Type checking failed. '-' only takes numbers, while calculating difference

dtccsundar — Wed, 30 Jun 2021 12:14:00 GMT

kamlesh_vaghela Thanks for your reply !!

But i am not seeing any value in the table command for "Pass % diff" after that .Can you please provide any other solution for this .

Re: I am getting the Error in 'eval' command: Type checking failed. '-' only takes numbers, while calculating difference

kamlesh_vaghela — Wed, 30 Jun 2021 12:41:17 GMT

@dtccsundar

Can you please try this?

index=x1 sourcetype=y1 OR sourcetype=y2 OR sourcetype=y3 OR sourcetype=y4 OR sourcetype=y5 OR sourcetype=y6 OR sourcetype=y7 earliest=-48h@h latest=-24h@h | chart count over sourcetype by Status | addtotals | eval dbyest_Pass=round((Pass/Total)*100,3) | eval dbyest_Fail=round((Fail/Total)*100,3) | stats count by sourcetype dbyest_Pass dbyest_Fail | rename Total as "Total Scope" | eval repo="dbyest" | append [ search index=x1 sourcetype=y1 OR sourcetype=y2 OR sourcetype=y3 OR sourcetype=y4 OR sourcetype=y5 OR sourcetype=y6 OR sourcetype=y7 earliest=-48h@h latest=-24h@h | chart count over sourcetype by Status | addtotals | eval yest_Pass=round((Pass/Total)*100,3) | eval yest_Fail=round((Fail/Total)*100,3) | stats count by sourcetype yest_Pass yest_Fail | rename Total as "Total Scope" | eval repo="yest"] | eval Pass_diff=round(dbyest_Pass-yest_Pass) | rename yest_Pass as "yest Pass %",yest_Fail as "yest Fail %", dbyest_Fail as "dbyest Fail %", dbyest_Pass as "dbyest Pass %", Pass_diff as "Pass % diff" | table "dbyest Pass %" "dbyest Fail %" "yest Pass %" "yest Fail %" "Pass % diff"

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: I am getting the Error in 'eval' command: Type checking failed. '-' only takes numbers, while calculating difference

dtccsundar — Wed, 30 Jun 2021 12:55:43 GMT

Thanks for your reply KV .

I got it by changing ,

| eval "dbyest Pass %"=round((Pass/Total)*100,3)

| eval "dbyest Pass%"=round(('Pass'/Total)*100,3)

and that worked .