topic Re: Regarding eval operations on the fields having special characters in Splunk Search

Regarding eval operations on the fields having special characters

sudhir_norway — Mon, 25 Apr 2022 08:49:51 GMT

I wanted to add this chaining command with my search and display total of the values under fields(columns) "a-b-1" and "a-b-2" and give the total results as total_requests

eval total_requests=a-b-1+a-b-2

where "a-b-1" and "a-b-2" is the field1 and field2 which i want to add using '+' operator

I have tried putting fields in double quotes and single quotes but unfortunately it is not working.

I can do it by renaming the fields but can someone suggest someway to do without renaming it.

Re: Regarding eval operations on the fields having special characters

ITWhisperer — Mon, 25 Apr 2022 08:55:11 GMT

Is this what you mean?

| eval total_requests='a-b-1'+'a-b-2'

Re: Regarding eval operations on the fields having special characters

sudhir_norway — Mon, 25 Apr 2022 08:58:55 GMT

Yes but its not working as expected

Re: Regarding eval operations on the fields having special characters

ITWhisperer — Mon, 25 Apr 2022 09:01:27 GMT

Can you give an example of when it is not giving the expected result? Also, is this happening for every event or just some of them?

Re: Regarding eval operations on the fields having special characters

sudhir_norway — Mon, 25 Apr 2022 09:21:37 GMT

| timechart span=10m count by host |rename a-b-1 as a1 |rename a-b-2 as a2 |eval total_requests=a1+a2

Above works as expected and chart displays with total_requests correctly

But when i tried

| timechart span=5m count by host |eval total_requests=a-b-1+a-b-2 then it dont work(I tried keeping both in single quotes and double quotes but didnt worked).Its not displaying the total

Below is the sample data and what i am looking for

Time	a-b-1	a-b-2	Total_requests
0:00	2	3	5
0:10	4	6	10
0:20	8	10	18

Re: Regarding eval operations on the fields having special characters

ITWhisperer — Mon, 25 Apr 2022 09:30:25 GMT

Here is a runanywhere example showing the syntax working.

| makeresults | eval _raw=" Time a-b-1 a-b-2 Total_requests 0:00 2 3 5 0:10 4 6 10 0:20 8 10 18" | multikv forceheader=1 | rename a_b_1 as "a-b-1" a_b_2 as "a-b-2" | fields Time "a-b-1" "a-b-2" | fields - _raw _time ``` the lines above set up example data as posted ``` | eval Total_requests='a-b-1'+'a-b-2'