topic Splunk eval not working with generated column in Splunk Search

Splunk eval not working with generated column

timcolpo — Tue, 29 Sep 2020 11:01:16 GMT

Need some help on some Splunk Search Syntax.

| inputlookup defect__kvs
| search (week_date="") (type="") (sub_type="") (model="") (sub_type=) (model=)
| eval total_polulation=700 (this will be a $token$ in a panel)
| stats count by failure sw_type
| rename count as num_failure

| eval pct_of_total=(num_failure/total_population) | table failure sw_type num_failure pct_of_total

pct_of_total does not produce a value.

I do not want to do appendcols or a subsearch as the Token is to be widely used and it works in other queries as a variable. Total_polulation cannot be derived from the Event Set.

Basically the totals are derived in the following XML

Re: Splunk eval not working with generated column

knielsen — Thu, 15 Sep 2016 12:27:01 GMT

is eval total_polulation copied from your actual query? If so, then your problem is the typo in it.

I just tried what you did with some other data/fields, and it works for me.

Re: Splunk eval not working with generated column

timcolpo — Thu, 15 Sep 2016 16:04:31 GMT

Thank for your response. Actually this was not a typo as I was editing the search to remove customer information. I did manage to get it to work but it was strange, for if I place the "|eval a=700" before the stats statement it does not compute, but after it it does. This was the final query.

THIS DOES NOT WORK

| inputlookup defect__kvs 
| search (week_date="*") (type="*") (sub_type="*") (model="*") (sub_type="*") (model="*") 
| eval total_population=700 | stats count by failure sw_type | rename count as num_failure
| eval pct_of_total=(num_failure/total_population) 
| rename count as num_failure | table failure sw_type num_failure pct_of_total

THIS DOES WORK

| inputlookup defect__kvs 
| search (week_date="*") (type="*") (sub_type="*") (model="*") (sub_type="*") (model="*") 
| stats count by failure sw_type | rename count as num_failure
| eval total_population=700
| eval pct_of_total=(num_failure/total_population) 
| rename count as num_failure | table failure sw_type num_failure pct_of_total