topic Re: Error when using eval in a range in Splunk Search

Error when using eval in a range

markthompson — Wed, 15 Oct 2014 09:57:25 GMT

Hi,
i have the following search query:

index=project_omega host=PersistUBS | transaction startswith="Targeting file BP_Comp_Summ_Pos*" endswith="Server returned an error: No such file or folder" OR "The file was downloaded successfully." | search "Error" OR "Attempt 3...unsuccessful."  | eval interval=relative_time(_time,"@d") | eval isFailure=if(searchmatch("Error") OR searchmatch("Attempt 3...unsuccessful."),1,0) | stats sum(isFailure) as failures | rangemap field=failures low=0-0 elevated=1-2 severe=3-15 default=15

But it's showing as N/A instead of a number, please can someone suggest why this is?

Re: Error when using eval in a range

MuS — Wed, 15 Oct 2014 11:39:21 GMT

Hi markthompson,

what will happen if you try something like this:

index=project_omega host=PersistUBS 
| transaction startswith="Targeting file BP_Comp_Summ_Pos*" endswith="Server returned an error: No such file or folder" OR "The file was downloaded successfully." 
| search "Error" OR "Attempt 3...unsuccessful."  
| eval interval=relative_time(_time,"@d") 
| eval isFailure=if(searchmatch("Error") OR searchmatch("Attempt 3...unsuccessful."),1,0) 
| stats sum(isFailure) as failures 
| eval failuresCategory = case(failures=0,"low",failures<3,"elevated",failures>=3,"severe")
| table failuresCategory

Maybe this will help you to get to the point.

cheers, MuS

Re: Error when using eval in a range

martin_mueller — Wed, 15 Oct 2014 20:10:36 GMT

Make sure you set the default range to something other than 15, probably default=critical or something like that.

Also note you're calculating an interval field but not using it.

Re: Error when using eval in a range

markthompson — Thu, 16 Oct 2014 09:38:54 GMT

Hi MuS Thanks for this answer.
However, I wish to use the rangemap command as it's configured on the dashboard to create a traffic light based on the level (low, elevated or severe)

Re: Error when using eval in a range

martin_mueller — Thu, 16 Oct 2014 09:52:15 GMT

Use eval to compute a field called range using the case suggested by @MuS and you'll have the same behaviour as rangemap, including dashboard visualizations using the field value as a CSS class.

Re: Error when using eval in a range

markthompson — Thu, 16 Oct 2014 10:02:59 GMT

Hey Martin, can you please give me an example of the string you would use and I'll mark it as answer if it works.

Re: Error when using eval in a range

martin_mueller — Thu, 16 Oct 2014 10:08:01 GMT

Basically what @MuS said:

...  | eval range = case(failures=0,"low",failures<3,"elevated",failures>=3,"severe")

Re: Error when using eval in a range

markthompson — Thu, 16 Oct 2014 10:13:14 GMT

I've tried this and then it still says N/A on my dashboard.

Current string:

 index=project_omega host=PersistUBS | transaction startswith="Targeting file BP_Comp_Summ_Pos*" endswith="Server returned an error: No such file or folder" OR "The file was downloaded successfully."  | search "Error" OR "Attempt 3...unsuccessful."  
 | eval interval=relative_time(_time,"@d") 
 | eval isFailure=if(searchmatch("Error") OR searchmatch("Attempt 3...unsuccessful."),1,0) 
 | stats sum(isFailure) as failures 
 | eval failuresCategory = case(failures=0,"low",failures<3,"elevated",failures>=3,"severe")
 | eval range = case(failures=0,"low",failures<3,"elevated",failures>=3,"severe")

Re: Error when using eval in a range

martin_mueller — Thu, 16 Oct 2014 10:44:36 GMT

Doesn't sound like a rangemap issue, this is the value showing N/A rather than the colour, right?

Make sure there actually are matching events in the time range to have something to sum up.

Re: Error when using eval in a range

markthompson — Thu, 16 Oct 2014 11:02:59 GMT

There are no events in Today that have failed, so it should default to low (green). Any ideas why it's not doing so?

Re: Error when using eval in a range

martin_mueller — Thu, 16 Oct 2014 11:05:26 GMT

The sum of "nothing" is not zero, it's "nothing" or rather null. To fix that, you could include this before the stats:

... | eval isFailure=... | append [stats count | eval isFailure=0] | stats sum(isFailure) as failures | ...

That'll make sure there always is at least one zero to sum up, guaranteeing a numeric sum.

Re: Error when using eval in a range

MuS — Thu, 16 Oct 2014 11:14:21 GMT

Just asking: why not a simple isnull eval instead of the appended subsearch?

...| eval isFailure=if(isnull(isFailure),"0",isFailure) | ...

Re: Error when using eval in a range

martin_mueller — Thu, 16 Oct 2014 11:15:36 GMT

When there are zero events that eval would be run zero times 😛

Re: Error when using eval in a range

MuS — Thu, 16 Oct 2014 11:18:33 GMT

true .. 🙂

Re: Error when using eval in a range

MuS — Thu, 16 Oct 2014 12:27:56 GMT

btw, just found a way to do this without append and it works with or without finding results. If it's okay I'll mail you the search so you can verify this twisted search 🙂

Re: Error when using eval in a range

martin_mueller — Thu, 16 Oct 2014 13:16:55 GMT

Post it here and let the world be your critic?

Re: Error when using eval in a range

MuS — Fri, 17 Oct 2014 11:57:17 GMT

Hi markthompson,

based on @martin_mueller 's answer and my comment, I did some research and tests, how this could be done without use of a sub search. It took a while, but here is what you can try and it should handle the case when there are no events at all during the search time range:

index=project_omega host=PersistUBS 
| transaction startswith="Targeting file BP_Comp_Summ_Pos*" endswith="Server returned an error: No such file or folder" OR "The file was downloaded successfully." 
| search "Error" OR "Attempt 3...unsuccessful."  
| eval isFailure=if(searchmatch("Error") OR searchmatch("Attempt 3...unsuccessful."),1,0) 
| stats count AS myCount sum(isFailure) as failures 
| eval failure=if(myCount=="0",0,failure)
| rangemap field=failures low=0-0 elevated=1-2 severe=3-15 default=15

hope this helps ...

cheers, MuS