Doing calculations using eval command with fields generated by timechart command.

[jvmerilla]

Hi,

I'm doing some search query where I used timechart command that creates fields. Now, what I want to do is to some calculations with this fields using eval command but nothing happens.

Here's my query:

index="sample_data" sourcetype="management_sampledata.csv" 
| timechart count(Ticket_No) as Inflow
| append 
    [search index="sample_data" sourcetype="management_sampledata.csv" Status=Closed 
    | timechart count(Ticket_No) as Closed/Cancelled 
    | fillnull]
| timechart first(*) as *
| eval Backlog_Total = (Inflow-Closed/Cancelled)

And here's the result:

What I was expecting to happen is a new field named "Backlog_Total" will be created using the eval command.

I hope someone can help me with this.

Thank you.

[kamlesh_vaghela · Accepted solution]

Hi

Can you please try this?

index="sample_data" sourcetype="management_sampledata.csv" 
 | timechart count(Ticket_No) as Inflow
 | append 
     [search index="sample_data" sourcetype="management_sampledata.csv" Status=Closed 
     | timechart count(Ticket_No) as "Closed/Cancelled"
     | fillnull]
 | timechart first(*) as *
 | eval Backlog_Total = (Inflow-'Closed/Cancelled')

I have just changed in Closed/Cancelled field.

Thanks

[jvmerilla]

Hi @kamlesh_vaghela,

It works!

Thank you again. 🙂

[kamlesh_vaghela]

Glad to help you.
Can you please accept the answer to close this question and upvote any comment which helps you.

Happy Splunking