topic Re: Doing calculations using eval command with fields generated by timechart command. in Splunk Search

Doing calculations using eval command with fields generated by timechart command.

jvmerilla — Thu, 30 Nov 2017 05:41:35 GMT

Hi,

I'm doing some search query where I used timechart command that creates fields. Now, what I want to do is to some calculations with this fields using eval command but nothing happens.

Here's my query:

index="sample_data" sourcetype="management_sampledata.csv" 
| timechart count(Ticket_No) as Inflow
| append 
    [search index="sample_data" sourcetype="management_sampledata.csv" Status=Closed 
    | timechart count(Ticket_No) as Closed/Cancelled 
    | fillnull]
| timechart first(*) as *
| eval Backlog_Total = (Inflow-Closed/Cancelled)

And here's the result:

What I was expecting to happen is a new field named "Backlog_Total" will be created using the eval command.

I hope someone can help me with this.

Thank you.

Re: Doing calculations using eval command with fields generated by timechart command.

kamlesh_vaghela — Thu, 30 Nov 2017 07:33:39 GMT

Can you please try this?

index="sample_data" sourcetype="management_sampledata.csv" 
 | timechart count(Ticket_No) as Inflow
 | append 
     [search index="sample_data" sourcetype="management_sampledata.csv" Status=Closed 
     | timechart count(Ticket_No) as "Closed/Cancelled"
     | fillnull]
 | timechart first(*) as *
 | eval Backlog_Total = (Inflow-'Closed/Cancelled')

I have just changed in Closed/Cancelled field.

Thanks

Re: Doing calculations using eval command with fields generated by timechart command.

jvmerilla — Thu, 30 Nov 2017 07:55:29 GMT

Hi @kamlesh_vaghela,

It works!

Thank you again. 🙂

Re: Doing calculations using eval command with fields generated by timechart command.

kamlesh_vaghela — Thu, 30 Nov 2017 08:07:45 GMT

Glad to help you.
Can you please accept the answer to close this question and upvote any comment which helps you.

Happy Splunking