topic Re: Error in 'eval' type check failed in Splunk Search

Error in 'eval' type check failed

jenkinsta — Tue, 01 Feb 2022 22:16:42 GMT

I have a json data from file generated from the okla speedtest -f json command. I have tried to cast it or eval in different ways but I am doing something wrong.

Error in 'eval' command: Type checking failed. '*' only takes numbers.

My search command is:

sourcetype="SpeedTest" | eval dmbs=(download.bandwidth)*8/1000000 | table _time download.bandwidth dmbs

And the example json is injected like this:

{ [-] download: { [-] bandwidth: 10420951 bytes: 81587520 elapsed: 7908 } interface: { [+] } isp: Vivo packetLoss: 0 ping: { [+] } result: { [+] } server: { [+] } timestamp: 2022-02-01T22:00:31Z type: result upload: { [-] bandwidth: 5706691 bytes: 80526240 elapsed: 14946 } }

Re: Error in 'eval' type check failed

ITWhisperer — Tue, 01 Feb 2022 22:31:01 GMT

Try single quotes around field names with dots in (otherwise it looks like you are trying to concatenate two strings which produces a type check error when you try to multiply the concatenated string).

sourcetype="SpeedTest" | eval dmbs='download.bandwidth'*8/1000000 | table _time download.bandwidth dmbs

Re: Error in 'eval' type check failed

isoutamo — Wed, 02 Feb 2022 22:19:18 GMT

Another option is rename those fields to something without dot in their names.