topic Re: Failed eval command from sub search numerical results in Splunk Search

Failed eval command from sub search numerical results- Any suggestions?

Seawheels51 — Tue, 21 Jun 2022 23:28:44 GMT

Hello gurus

I'm trying to return a percentage from the results of sub searches. The value User_count and Device_count are numerical but the eval returns nothing. If I convert either of the values to a number and leave the other named the eval works. Could you offer a suggestion to make this search work please? Thank you!

Re: Failed eval command from sub search numerical results

isoutamo — Tue, 21 Jun 2022 06:55:57 GMT

if you are using the same time period for both user and devices you can try this

index="test" earliest=-2d@d latest=-1d@d | stats dc(User) as User_count dc(SerialNumber) as Device_count | eval perc=round(User_count/Device_count*100, 2)."%"

In SPL you should almost always replace join, append* with stats. There are lot of presentation what to do it e.g. https://conf.splunk.com/watch/conf-online.html?search=%22Nick%20Mealy%22#/ are links to Nick's "yearly" conf presentations.

r. Ismo

Re: Failed eval command from sub search numerical results- Any suggestions?

Seawheels51 — Wed, 22 Jun 2022 18:36:04 GMT

Thank you, that achieved the desired results! I appreciate the prompt and accurate response, well done!