topic Re: Alternative for eval while using pivot in Splunk Search

Alternative for eval while using pivot

sushmitha_mj — Wed, 20 May 2015 16:59:36 GMT

I wanted to accelerate my searches so I am using data models and pivot.

| pivot Accounting Accounting  sum(Input) AS "Input" sum(Output) AS "Output" dc(User_Name) AS "Distinct Count of User_Name" SPLITROW _time AS _time PERIOD hour SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1

I want to do a simple sum(Input)/10000 as "input" (Division by 10000) that's all.
I tried using stats before the sum and also eval, but it does not work on a pivot. How can I do this?

Re: Alternative for eval while using pivot

alacercogitatus — Wed, 20 May 2015 21:21:04 GMT

I don't currently have a way to test this, but if it behaves like the timechart command, you should be able to do this:

| pivot Accounting Accounting  sum(eval(Input/1000))  AS "Input" sum(Output) AS "Output" dc(User_Name) AS "Distinct Count of User_Name" SPLITROW _time AS _time PERIOD hour SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1

Re: Alternative for eval while using pivot

emoyoun — Thu, 17 Nov 2016 23:11:51 GMT

I tried this and it didn't work.
| pivot Statistics HTTP sum(eval(count/3600)) AS "Total Number of Transactions"

I get this error:
Error in 'PivotCell': The object 'HTTP' has no field 'eval(count/3600'.

Any ideas??

Re: Alternative for eval while using pivot

emoyoun — Thu, 17 Nov 2016 23:12:44 GMT

I downvoted this post because i tried the same and it didn't work for me.

Re: Alternative for eval while using pivot

ppablo — Thu, 17 Nov 2016 23:23:11 GMT

Hi @emoyoun

Please reserve downvoting for answers and suggestions that could potentially be harmful for a Splunk environment, not just because something didn't work for you. as this solution can be useful for other users. Please review how voting etiquette works in the Splunk community and this forum before further engaging in the forum.
https://answers.splunk.com/answers/244111/proper-etiquette-and-timing-for-voting-here-on-ans.html