topic Re: Fields & Transforming Search Results in Splunk Search

Fields & Transforming Search Results

srw46 — Mon, 28 Sep 2020 09:46:34 GMT

Hello all,

I am using the follow string:

*SEARCH TERM/MACROS HERE* | eval over = if (ttm_transaction_time>ttm_threshold, 1, 0) | stats sum(over) AS "Over_Threshold" count AS "Total" | eval Percentage = round (100-(Over_Threshold/Total*100),2)

The results table then displays the columns I expect i.e. :

Over_Threshold , Total , Percentage

If I then try to add another (existing) field to the results using the following string:

*SEARCH TERM/MACROS HERE* | eval over = if (ttm_transaction_time>ttm_threshold, 1, 0) | stats sum(over) AS "Over_Threshold" count AS "Total" BY ttm_transaction_id | eval Percentage = round (100-(Over_Threshold/Total*100),2)

I am expecting the results to display:

Over_Threshold , Total , ttm_transaction_id, Percentage

But instead they display

Over_Threshold , Total , ttm_transaction_id

And seem to drop the Percentage column.

Can anybody give me advice as to why this is happening or how I can change it to present the four columns I want (and possibly more)?

Re: Fields & Transforming Search Results

Ledion_Bitincka — Wed, 03 Aug 2011 01:40:29 GMT

The only time when eval is not going to create the result field is if any of the fields on the right hand side of the = are not present. How do your results if you remove the eval look like (the first few rows would suffice)?

Re: Fields & Transforming Search Results

srw46 — Wed, 03 Aug 2011 08:19:27 GMT

I thought eval could create fields too?

Which eval should I try removing?

Re: Fields & Transforming Search Results

srw46 — Wed, 03 Aug 2011 08:23:54 GMT

Eval creates the Percentage field fine in the first example but not the second? Also, I have two eval commands, which are suggesting I remove?

Re: Fields & Transforming Search Results

hjwang — Wed, 03 Aug 2011 08:59:47 GMT

Sounds weird, I just try this search string similiarly, and it will generate four column as expected, but by default the count by field stands as the first column

Re: Fields & Transforming Search Results

srw46 — Wed, 10 Aug 2011 07:17:05 GMT

Does anybody else have any suggestions for this issue?

I've tried umpteen ways of re-ordering the commands but to no avail.

Re: Fields & Transforming Search Results

srw46 — Wed, 10 Aug 2011 08:25:15 GMT

I've now managed to solve this problem. Thanks for your guidance.

Re: Fields & Transforming Search Results

gordone — Wed, 25 Jan 2017 20:19:52 GMT

Care to say what you did/tweaked?