topic Re: problem using lookup output field in Splunk Search

problem using lookup output field

changux — Fri, 09 Sep 2016 08:20:49 GMT

Hi all.
I have an automatic file lookup configured to output some fields and works very well (using the sourcetype):

sourcetype=datavalue *

The field from the automatic lookup is GOAL1. This field only has a integer numeric value.

Next, i tried to run:

sourcetype=datavalue ORDER=pending | stats count AS s | eval FINAL = (s * 100)/GOAL1

But the result of FINAL is not shown. If i remove the division per GOAL1, is fine (s * 100). First, i reckoned that maybe GOAL1 has some problem, but with

sourcetype=datavalue | table GOAL1

i can see the integer as unique value.

Any idea?

Re: problem using lookup output field

gcusello — Fri, 09 Sep 2016 10:58:59 GMT

how is your lookup done?
I tried with a lookup not automatic, but called in the search, and it's ok!
Bye?
Giuseppe

Re: problem using lookup output field

mhpark — Fri, 09 Sep 2016 13:31:35 GMT

you would like to check if your GOAL1 is really an numeric, not a string.
try

| eval GOAL1 = tonumber(GOAL1)

or something and do the math again