Monitoring Splunk

Error in 'stats' command: The number of wildcards between field specifier '((Success/Total)*100).%' and rename specifier

Nafees
Explorer

Hi There,

I am running below query,

base search | rename msg.message as "message", msg.customer as "customer" | stats count as Total, count(eval(isnull(msg.errorCode))) as Success, count(eval(isnotnull(msg.errorCode))) as Error, eval(((Success/Total)*100)."%") as SuccessRate by customer

and I am getting below error.

Error in 'stats' command: The number of wildcards between field specifier '((Success/Total)*100).%' and rename specifier 'SuccessRate' do not match. Note: empty field specifiers implies all fields, e.g. sum() == sum(*).

Can anyone please tell me where I am wrong?

basically I want to calculate a percent of total successful events here.

Thanks!!!

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Nafees,

you can use the eval command in stats, but only to filter results for a function, not for calculation, please try this:

base search 
| rename msg.message as "message", msg.customer as "customer" 
| stats 
   count AS Total
   count(eval(isnull(msg.errorCode))) AS Success 
   count(eval(isnotnull(msg.errorCode))) AS Error
   BY customer
| eval SuccessRate=(((Success/Total)*100)."%")

Ciao.

Giuseppe

View solution in original post

Nafees
Explorer

yes @gcusello , my apologies. Its working fine, I got confused at the start but when I tried this, it is working now. Thanks for your help as always. 🙂 One more Karma is on its way for you !!! 🙂

0 Karma

Nafees
Explorer

Hi @gcusello ,

thanks for response, but I want to show Total, Success and Success Rate in one table which is grouped by the customers. How to do that then?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Nafees,

did you tried my solution?

with it you have, for each customer, Total, Success and Success Rate on the same row.

What's the issue?

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Nafees,

you can use the eval command in stats, but only to filter results for a function, not for calculation, please try this:

base search 
| rename msg.message as "message", msg.customer as "customer" 
| stats 
   count AS Total
   count(eval(isnull(msg.errorCode))) AS Success 
   count(eval(isnotnull(msg.errorCode))) AS Error
   BY customer
| eval SuccessRate=(((Success/Total)*100)."%")

Ciao.

Giuseppe

PickleRick
SplunkTrust
SplunkTrust

Actually, while your solution as such is OK, the underlying explanation is not.

As I wrote in a feedback to the docs (which should have been included already, but for some reason still isn't), it works a bit different than just filtering.

The expression provided in eval() statement is evaluated and - true/false in case of count() is treated the same way as not null/null. That's why count(eval(a>b)) works like filtering. But that's due to implicit operations performed on the eval result. But understanding stats with eval() as filtering leads to wrongly built searches and/or bad results.

| stat agg(eval(expression))

is equivalent (remembering about the implicit conversion and the fact that you can't assign a boolean value to a field) to

| eval b=expression | stat agg(b)

Since stat with eval is often used with count as aggregation function, it might be indeed interpreted as filtering but it is not.

Example:

| makeresults count=10 
| streamstats count
| stats count(eval(count>4)) as c4
              sum(eval(count>4)) as s4
              sum(eval(if(count>4,count,null()))) as si4
              sum(eval(count*count)) as cs4

As you can see from this run-anywhere example, the count will give you proper number of events which have the count number higher than 4. There are of course 6 such events. But you can't sum booleans so the s4 field will be null. But the si4 field will contain sum of all count fields with value bigger than 4 and cs4 will contain sum of squares of all values of field count.

The reason for OP's error was lack of aggregation function, not eval as such.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...