Splunk Search

Error in 'eval' type check failed

jenkinsta
Path Finder

I have a json data from file generated from the okla speedtest -f json command. I have tried to cast it or eval in different ways but I am doing something wrong. 

Error in 'eval' command: Type checking failed. '*' only takes numbers.

My search command is: 

sourcetype="SpeedTest"
| eval dmbs=(download.bandwidth)*8/1000000 
| table _time download.bandwidth dmbs

And the example json is injected like this:

{ [-]
   download: { [-]
     bandwidth: 10420951
     bytes: 81587520
     elapsed: 7908
   }
   interface: { [+]
   }
   isp: Vivo
   packetLoss: 0
   ping: { [+]
   }
   result: { [+]
   }
   server: { [+]
   }
   timestamp: 2022-02-01T22:00:31Z
   type: result
   upload: { [-]
     bandwidth: 5706691
     bytes: 80526240
     elapsed: 14946
   }
}

 

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try single quotes around field names with dots in (otherwise it looks like you are trying to concatenate two strings which produces a type check error when you try to multiply the concatenated string).

sourcetype="SpeedTest"
| eval dmbs='download.bandwidth'*8/1000000 
| table _time download.bandwidth dmbs

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try single quotes around field names with dots in (otherwise it looks like you are trying to concatenate two strings which produces a type check error when you try to multiply the concatenated string).

sourcetype="SpeedTest"
| eval dmbs='download.bandwidth'*8/1000000 
| table _time download.bandwidth dmbs
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Another option is rename those fields to something without dot in their names.
0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...