Splunk Dev

getting error with stats

jiaqya
Builder

i have numbers in Yes and Total columns and am trying to get a result using stats . but i keep getting error. not sure how to do this, can you help.

|stats eval(Yes/Total)*100 as Compliance

Error in 'stats' command: The aggregation specifier 'eval(Yes/Total)*100' is invalid. The aggregation specifier must be in func_name format.

Tags (1)
0 Karma
1 Solution

cmerriman
Super Champion

you cannot use eval inside of a stats command like that. try forming it more like this
|eval Compliance=(Yes/Total)*100)|stats values(Compliance) as Compliance

View solution in original post

0 Karma

cmerriman
Super Champion

you cannot use eval inside of a stats command like that. try forming it more like this
|eval Compliance=(Yes/Total)*100)|stats values(Compliance) as Compliance

0 Karma

jiaqya
Builder

Hi , thanks for your response, i tried what you gave above, but it did not give me the correct output.

the output of Yes, Total and Compliance is below. its already updated. what i am trying is to get the average value of Compliance. if i do avg(compliance) i get a different value and if i do sum(yes)/sum(total)*100 for compliance i get a different value, which is the correct one.

could you help me get the correct average from this table using stats or any other way.

Yes Total Compliance
0 1 0
0 4 0
1 1 100
224 225 99.56
5 5 100
15 15 100
88 92 95.65

0 Karma

cmerriman
Super Champion

how about something like this?
...|addcoltotals labelfield=Compliance|search Compliance="Total"|eval Compliance=(Yes/Total)*100

i put your data in this table so you can see what i did:

|makeresults|eval data="Yes=0,Total=1,Compliance=0 Yes=0,Total=4,Compliance=0 Yes=1,Total=1,Compliance=100 Yes=224,Total=225,Compliance=99.56 Yes=5,Total=5,Compliance=100 Yes=15,Total=15,Compliance=100 Yes=88,Total=92,Compliance=99.65"|makemv data|mvexpand data|rename data as _raw|kv|table Yes Total Compliance|addcoltotals labelfield=Compliance|search Compliance="Total"|eval Compliance=(Yes/Total)*100
0 Karma

jiaqya
Builder

it did help me . thanks

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...