Error in 'eval' command: The expression is malformed. Expected

[simingmplatform]

Hi ALL,
need help for a using case here.

we are trying to setup alert based on below data
value1 ( the average of past 7days since yesterday)
value2 ( the average of yesterday's day)

if value2 is lower than 70% of value1 , trigger alerts.
below is what I use to setup this query

index=main topoName=EnrichmentTopology datacenter=NA desc=ENR131 earliest=-7d@d latest=-2d@d | stats avg(value) as 7day by desc | appendcols [ search index=main topoName=EnrichmentTopology datacenter=NA desc=ENR131 earliest=-2d@d latest=-1d@d | stats avg(value) as 1day by desc] | eval diff=(7day-1day)

but it always return me
Error in 'eval' command: The expression is malformed. Expected ).

any idea ? thx a lot

[jpolvino]

You may want to consider using multisearch:

| multisearch
[search index=main topoName=EnrichmentTopology datacenter=NA desc=ENR131 earliest=-7d@d latest=-2d@d | stats avg(value) as prevWeek]
[search index=main topoName=EnrichmentTopology datacenter=NA desc=ENR131 earliest=-2d@d latest=-1d@d | stats avg(value) as prevDay]
| eval alert=if(prevDay<(prevWeek*0.7),"Alert","No alert")

It doesn't look like you need a "by" clause in your stats, since there is only 1 value for desc.

[richgalloway · Accepted solution]

Yes, eval is allowed with stats. The problem appears to be with the field names which begin with digits. Put them inside single quotes to force Splunk to treat them as field names. ... | eval diff=('7day'-'1day')

[simingmplatform]

correct, its after we use day7 and day1 , issue is gone, thx

[simingmplatform]

everything works before | eval part , I guess we cannot use eval with stats ?