topic Re: I am trying to subtract one column from another and want to do it for other columns as well by using foreach in Splunk Search

I am trying to subtract one column from another and want to do it for other columns as well by using foreach

nkankur — Wed, 01 Nov 2017 12:46:04 GMT

My data is like this
Column1 Column2 Column3 Total

I am using the below command
|foreach Column* [ eval Answer <> = Total - <> ]
|table Column1, Column2, Column3 Answer1, Answer2, Answer3

but I getting the below error
Error in 'foreach' command: The last argument must be a search pipeline

Kindly Help me with this issue.

Re: I am trying to subtract one column from another and want to do it for other columns as well by using foreach

somesoni2 — Wed, 01 Nov 2017 13:20:12 GMT

Try this

host=1 | tabel Column* Total
| foreach Column* [ eval Answer<<MATCHSTR>>=Total-<<FIELD>>]

Re: I am trying to subtract one column from another and want to do it for other columns as well by using foreach

nkankur — Wed, 01 Nov 2017 14:33:55 GMT

I am still getting the error as given below,

No results found.

Re: I am trying to subtract one column from another and want to do it for other columns as well by using foreach

somesoni2 — Wed, 01 Nov 2017 14:36:09 GMT

Try this

host=1 | tabel Column* Total
 | foreach Column* [ | eval "Answer<<MATCHSTR>>"=Total-'<<FIELD>>']

Re: I am trying to subtract one column from another and want to do it for other columns as well by using foreach

nkankur — Wed, 01 Nov 2017 14:57:02 GMT

Thanks a lot for your support but still getting the same error.

Re: I am trying to subtract one column from another and want to do it for other columns as well by using foreach

somesoni2 — Wed, 01 Nov 2017 15:08:27 GMT

Strange. The same syntax works for me. See this runanywhere search.

| gentimes start=-1 | eval Column1=10 | eval Column2=20 | eval Column3=30 | table Column* | addtotals 
| foreach Column* [eval "Answer<<MATCHSTR>>"=Total-'<<FIELD>>']

If above works for you, please check closely if there is syntax error on your side (no extra space or anything).

Re: I am trying to subtract one column from another and want to do it for other columns as well by using foreach

nkankur — Thu, 02 Nov 2017 09:28:30 GMT

Yes your code is working just fine, but I am still stuck. I will share the code which I am using,Please guide me if there is any error in that.

When I am using below command it is showing data.

| table V* Voice

Re: I am trying to subtract one column from another and want to do it for other columns as well by using foreach

nkankur — Thu, 02 Nov 2017 09:31:03 GMT

V1 V2 V3 Voice
1000 0 0 1000
1000 0 0 1200
1000 0 0 1300

But after the below command it is showing no results.
| table V* Voice
| foreach V* [ eval "Answer<>"=Voice-'<>']

No Results