Splunk Search

Error in 'eval' type check failed

jenkinsta
Path Finder

I have a json data from file generated from the okla speedtest -f json command. I have tried to cast it or eval in different ways but I am doing something wrong. 

Error in 'eval' command: Type checking failed. '*' only takes numbers.

My search command is: 

sourcetype="SpeedTest"
| eval dmbs=(download.bandwidth)*8/1000000 
| table _time download.bandwidth dmbs

And the example json is injected like this:

{ [-]
   download: { [-]
     bandwidth: 10420951
     bytes: 81587520
     elapsed: 7908
   }
   interface: { [+]
   }
   isp: Vivo
   packetLoss: 0
   ping: { [+]
   }
   result: { [+]
   }
   server: { [+]
   }
   timestamp: 2022-02-01T22:00:31Z
   type: result
   upload: { [-]
     bandwidth: 5706691
     bytes: 80526240
     elapsed: 14946
   }
}

 

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try single quotes around field names with dots in (otherwise it looks like you are trying to concatenate two strings which produces a type check error when you try to multiply the concatenated string).

sourcetype="SpeedTest"
| eval dmbs='download.bandwidth'*8/1000000 
| table _time download.bandwidth dmbs

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try single quotes around field names with dots in (otherwise it looks like you are trying to concatenate two strings which produces a type check error when you try to multiply the concatenated string).

sourcetype="SpeedTest"
| eval dmbs='download.bandwidth'*8/1000000 
| table _time download.bandwidth dmbs
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Another option is rename those fields to something without dot in their names.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...