topic Re: Eval failing after join in Splunk Search

Why is eval failing after join?

rakeshkiit — Fri, 10 Feb 2023 20:30:42 GMT

index=na160 starttime="02/02/2023:00:00:00" endtime="02/02/2023:24:00:00" requestId="TID:131610985000004c2d"
|stats count as 240_COUNT by logRecordType
| join logRecordType type=outer
[search index=na160 starttime="02/08/2023:00:00:00" endtime="02/08/2023:24:00:00" requestId="TID:348627200000212ea7"
| stats count as 242_COUNT by logRecordType]
| eval difference = (242_COUNT - 240_COUNT)
| table logRecordType, 240_COUNT, 242_COUNT, difference

Above eval fails after joining two dataset
Error in 'eval' command: The expression is malformed.

Appreciate your help here to mitigate this issue.

Re: Eval failing after join

bowesmana — Fri, 10 Feb 2023 05:16:22 GMT

On the right hand side of an eval statement if the field name starts with numbers or contains '.' or other non standard characters, you must wrap the field name in single quotes

| eval difference = ('242_COUNT' - '240_COUNT')

Re: Eval failing after join

bowesmana — Fri, 10 Feb 2023 05:20:48 GMT

Note that using join is not good practice, as it's rarely necessary in Splunk and has limitations, which can give unpredictable results.

You can achieve the same thing using stats

index=na160 (starttime="02/02/2023:00:00:00" endtime="02/02/2023:24:00:00" requestId="TID:131610985000004c2d") OR (starttime="02/08/2023:00:00:00" endtime="02/08/2023:24:00:00" requestId="TID:348627200000212ea7") | stats count(eval(requestId="TID:131610985000004c2d")) as 240_COUNT count(eval(requestId="TID:348627200000212ea7")) as 242_COUNT by logRecordType | eval difference = (242_COUNT - 240_COUNT) | table logRecordType, 240_COUNT, 242_COUNT, difference

Re: Eval failing after join

rakeshkiit — Fri, 10 Feb 2023 06:27:55 GMT

Given example is simplified version of query, however in actual requestId is coming from another dataset

Re: Eval failing after join

bowesmana — Fri, 10 Feb 2023 06:46:33 GMT

All good - just it's useful to not start your Splunk life with join - it's really worth getting your head around how to use stats+eval to join data sets. You will not regret it 😁 join can often lead you down a miserable path wondering why things don't do what you expect.