topic Re: Eval usage limit? in Splunk Search

Eval usage limit?

kmattern — Tue, 08 Apr 2014 20:35:50 GMT

Is there a limit to the number of eval functions that can be used in a single search? It appears that using more than about 17 eval statements the search will not even try to run. I just get a greyed out searchbar and a prohibited mouse pointer. I have one search that has 17 evals and it runs but I can't seem to cross that limit.

Re: Eval usage limit?

martin_mueller — Tue, 08 Apr 2014 20:49:29 GMT

A large nubmer of eval calls in and of themselves seem fine to me:

| stats count
| eval foo0 = 1 | eval foo1 = 1 | eval foo2 = 1 | eval foo3 = 1 | eval foo4 = 1 | eval foo5 = 1 | eval foo6 = 1 | eval foo7 = 1 | eval foo8 = 1 | eval foo9 = 1
| eval foo10 = 1 | eval foo11 = 1 | eval foo12 = 1 | eval foo13 = 1 | eval foo14 = 1 | eval foo15 = 1 | eval foo16 = 1 | eval foo17 = 1 | eval foo18 = 1 | eval foo19 = 1
| eval foo20 = 1 | eval foo21 = 1 | eval foo22 = 1 | eval foo23 = 1 | eval foo24 = 1 | eval foo25 = 1 | eval foo26 = 1 | eval foo27 = 1 | eval foo28 = 1 | eval foo29 = 1

Re: Eval usage limit?

kmattern — Tue, 08 Apr 2014 21:20:17 GMT

My evals tend to look like this.

Re: Eval usage limit?

linu1988 — Tue, 08 Apr 2014 21:59:44 GMT

what are those dots doing int he bracket? on first look the query is wrong with mismatching quotes

Re: Eval usage limit?

kristian_kolb — Wed, 09 Apr 2014 06:30:41 GMT

edited the comment to format as <code>, which shows the HTML kmattern is trying to create - I guess ...

Re: Eval usage limit?

martin_mueller — Wed, 09 Apr 2014 07:56:34 GMT

Running this query works without a hitch for me, with about four dozen evals:

Re: Eval usage limit?

devin_stonecyph — Wed, 10 Sep 2014 22:31:24 GMT

Try using a case statement instead of all those ifs.

Re: Eval usage limit?

martin_mueller — Wed, 10 Sep 2014 22:48:39 GMT

There are no if expressions in the posted searches.