topic Re: is eval the right choice? in Splunk Search

is eval the right choice?

mikefoti — Thu, 12 Apr 2012 19:14:58 GMT

The query below displays accurate values for Requests, Accepted, Rejected and %Accepted.

| stats count(eval(nps_packetType=1)) AS "Requests", 
  count(eval(nps_packetType=2)) AS "Accepted", 
  count(eval(nps_packetType=3)) AS "Rejected" 
| eval %Accepted=round((Accepted/Requests*100))

How can add a code similar to below so it also calculates & displays %Rejected

| eval %Rejected=round((Rejected/Requests*100))

Also, I calculated values for Accepted and Rejected only because I believe I need them to calculate the percentages. But is there a way to NOT display values for Accepted & Rejected?
Seems the syntax for EVAL requires I use "AS" which then seems to assume I want the values displayed.

Re: is eval the right choice?

kristian_kolb — Thu, 12 Apr 2012 19:39:30 GMT

Yes, you can add the fields command at the end of the query;

... | fields - Rejected, Accepted

Hope this helps,

Kristian

Re: is eval the right choice?

mikefoti — Thu, 12 Apr 2012 19:41:25 GMT

Thanks Kristian. That answers the 2nd portion of the question. Any idea on the first... how to display %Rejected along with %Accepted??

Re: is eval the right choice?

kristian_kolb — Thu, 12 Apr 2012 19:45:43 GMT

I thought you just had all that in one query, i.e. the stats and the two eval statements. Did it not work?

Re: is eval the right choice?

mikefoti — Mon, 28 Sep 2020 11:40:28 GMT

No. Trying to simply append this line to the end of the working query does not work.
... eval %Rejected=round((Rejected/Requests*100))

For example, the below fails because of the last EVAL statement.

| stats count(eval(nps_packetType=1)) AS "Requests",
count(eval(nps_packetType=2)) AS "Accepted",
count(eval(nps_packetType=3)) AS "Rejected"
| eval %Accepted=round((Accepted/Requests*100))
eval %Rejected=round((Rejected/Requests*100))

Re: is eval the right choice?

kristian_kolb — Thu, 12 Apr 2012 20:05:42 GMT

You need to have a pipe between the evals.

...| stats blaha | eval x=y/z | eval q=w/e

Re: is eval the right choice?

mikefoti — Thu, 12 Apr 2012 20:09:10 GMT

Unfortunately that does not work because both "eval %Accepted" and "eval $Rejected" need what is piped from the STATS function.

Re: is eval the right choice?

gkanapathy — Thu, 12 Apr 2012 20:39:03 GMT

kristian.kolb's suggestion works just fine. simply make sure you do | fields after both evals.

Re: is eval the right choice?

kristian_kolb — Thu, 12 Apr 2012 21:33:16 GMT

yep, I could have been a bit clearer on that.

Also, I've never used '%' as part of a field name, could that be causing trouble, need quoting/escaping or something like that?

Re: is eval the right choice?

gkanapathy — Thu, 12 Apr 2012 21:41:19 GMT

Using "%" in a field name could cause problems in some places, though you can deal with it by enclosing the field name with single quotes. In this case, it's not a problem.

Re: is eval the right choice?

mikefoti — Fri, 13 Apr 2012 14:44:37 GMT

It all works perfectly now that I do |fields at the right place. Thanks both for your help!