topic Re: Trying chart of multiple data series wtih tutoriel but error with eval in Splunk Search

Trying chart of multiple data series wtih tutoriel but error with eval

echozero39 — Mon, 28 Sep 2020 20:06:03 GMT

I am tring to run a chart report followting the exemple from Search manual p.71, I get a field named "Serveur"
index="" sourcetype="" |
stats count(CPU=0) as 0_CPU avg(CPU) as avg_CPU by _time Serveur |
eval s1="CPU_0 avgCPU" |
makemv s1 | mvexpand s1|
eval yval=case(s1=="CPU_0",0_CPU,s1=="avgCPU",avg_CPU) |
eval series=Serveur+":"s1 | xyseries _time series yval

but there is an error with that eval in black, it shows "Error in 'eval' command: The expression is malformed. Expected )", but I just can't find where I missed the ")". Thanks for helping me.

Re: Trying chart of multiple data series wtih tutoriel but error with eval

stephanefotso — Fri, 29 May 2015 09:03:32 GMT

Hello!n I think the error is here: eval series=Serveur+":"s1. Here is what to write: eval series=Serveur+":"+s1
Thanks

Re: Trying chart of multiple data series wtih tutoriel but error with eval

echozero39 — Fri, 29 May 2015 09:11:27 GMT

Thanks for your answer, that was a mistake occurred when I typed the question
The problem is the eval in black anyway,

in fact I did test without the last line and it gave me always:

Error in 'eval' command: The expression is malformed. Expected ).

😞

Re: Trying chart of multiple data series wtih tutoriel but error with eval

stephanefotso — Fri, 29 May 2015 09:50:00 GMT

Here you go:

index="" sourcetype="" | 
stats count(eval(CPU="0")) as 0_CPU avg(CPU) as avg_CPU by _time Serveur | 
eval s1="CPU_0 avgCPU" | 
makemv s1 | mvexpand s1| 
eval yval=case(s1=="CPU_0",0_CPU,s1=="avgCPU",avg_CPU) | 
eval series=Serveur+":"+s1 | xyseries _time series yval

Re: Trying chart of multiple data series wtih tutoriel but error with eval

echozero39 — Mon, 28 Sep 2020 20:06:06 GMT

Thanks again !
But It doesn't work, always the same error.

this eval make the whole command goes wrong : eval yval=case(s1=="CPU_0",0_CPU,s1=="avgCPU",avg_CPU

Re: Trying chart of multiple data series wtih tutoriel but error with eval

hmozaffari — Fri, 29 May 2015 12:28:08 GMT

You forgot to enclose them with double quote :

eval yval=case(s1="CPU_0","0_CPU",s1="avgCPU","avg_CPU")

Re: Trying chart of multiple data series wtih tutoriel but error with eval

echozero39 — Fri, 29 May 2015 12:39:06 GMT

That's a copy/paste issue..

index="" sourcetype="" | 
 stats count(eval(CPU="0")) as 0_CPU avg(CPU) as avg_CPU by _time Serveur | 
 eval s1="CPU_0 avgCPU" | 
 makemv s1 | mvexpand s1| 
 eval yval=case(s1=="CPU_0",0_CPU,s1=="avgCPU",avg_CPU) | 
 eval series=Serveur+":"+s1 | xyseries _time series yval

and

index="" sourcetype="" | 
 stats count(CPU=0) as 0_CPU avg(CPU) as avg_CPU by _time Serveur | 
 eval s1="CPU_0 avgCPU" | 
 makemv s1 | mvexpand s1| 
 eval yval=case(s1=="CPU_0",0_CPU,s1=="avgCPU",avg_CPU) | 
 eval series=Serveur+":"+s1 | xyseries _time series yval

both not working in my splunk

Re: Trying chart of multiple data series wtih tutoriel but error with eval

echozero39 — Fri, 29 May 2015 12:42:09 GMT

either

index="" sourcetype="" | 
  stats count(eval(CPU="0")) as 0_CPU avg(CPU) as avg_CPU by _time Serveur | 
  eval s1="CPU_0 avgCPU" | 
  makemv s1 | mvexpand s1| 
  eval yval=case(s1=="CPU_0",0_CPU,s1=="avgCPU",avg_CPU) | 
  eval series=Serveur+":"+s1 | xyseries _time series yval

 index="" sourcetype="" | 
  stats count(CPU=0) as 0_CPU avg(CPU) as avg_CPU by _time Serveur | 
  eval s1="CPU_0 avgCPU" | 
  makemv s1 | mvexpand s1| 
  eval yval=case(s1=="CPU_0",0_CPU,s1=="avgCPU",avg_CPU) | 
  eval series=Serveur+":"+s1 | xyseries _time series yval

both having error : Error in 'eval' command: The expression is malformed. Expected ).

Maybe it's a version issue ? I am using 6.2.2, the search manual is 6.3.2

Re: Trying chart of multiple data series wtih tutoriel but error with eval

hmozaffari — Mon, 28 Sep 2020 20:06:09 GMT

I still see double quotes missing. I ran the following on 6.2.2 and didn`t get any error:

index="" sourcetype="" | 
   stats count(CPU=0) as 0_CPU avg(CPU) as avg_CPU by _time Serveur | 
   eval s1="CPU_0 avgCPU" | 
   makemv s1 | mvexpand s1| 
   eval yval=case(s1=="CPU_0","0_CPU",s1=="avgCPU","avg_CPU") | 
   eval series=Serveur+":"+s1 | xyseries _time series yval

eval yval=case(s1=="CPU_0","0_CPU",s1=="avgCPU","avg_CPU") |

Re: Trying chart of multiple data series wtih tutoriel but error with eval

echozero39 — Mon, 28 Sep 2020 20:06:12 GMT

that ran without error, but I didn't get the result I want.

In fact, I want to be able to ran this :
index=* sourcetype=* | timechart count(CPU=0) avg(CPU) by Serveur

However, timechart does not support multiple data series, and the exmple of The Search manual shows that I can run a similar search,

Can you help me find out the reason ? Thank you in advance !

Re: Trying chart of multiple data series wtih tutoriel but error with eval

stephanefotso — Fri, 29 May 2015 21:48:52 GMT

OK. I think the problem is that 0_CPU. The name of the field is incorect.. It must not start with a digit. Change the name of that field and use for example nulcpu.

 index="" sourcetype="" | 
  stats count(eval(CPU="0")) as nulcpu avg(CPU) as avg_CPU by _time Serveur | 
  eval s1="CPU_0 avgCPU" | 
  makemv s1 | mvexpand s1| 
  eval yval=case(s1=="CPU_0",nulcpu,s1=="avgCPU",avg_CPU) | 
  eval series=Serveur+":"+s1 | xyseries _time series yval

I'm sure it will work now.
Thanks.

Re: Trying chart of multiple data series wtih tutoriel but error with eval

stephanefotso — Fri, 29 May 2015 21:52:37 GMT

OK. I think the problem is that 0_CPU. The name of the field is incorect. It must not start with a digit. Change the name of that field and use for example nulcpu.

index="" sourcetype="" | 
   stats count(eval(CPU="0")) as nulcpu avg(CPU) as avg_CPU by _time Serveur | 
   eval s1="CPU_0 avgCPU" | 
   makemv s1 | mvexpand s1| 
   eval yval=case(s1=="CPU_0",nulcpu,s1=="avgCPU",avg_CPU) | 
   eval series=Serveur+":"+s1 | xyseries _time series yval

I'm sure it will work now.
Thanks.

Re: Trying chart of multiple data series wtih tutoriel but error with eval

echozero39 — Mon, 01 Jun 2015 07:05:29 GMT

thank you so much, that one works...

Re: Trying chart of multiple data series wtih tutoriel but error with eval

stephanefotso — Tue, 02 Jun 2015 12:29:36 GMT

The answer to accept is the one bellow. I did not received any point