Splunk Search

Error in 'eval' type check failed

jenkinsta
Path Finder

I have a json data from file generated from the okla speedtest -f json command. I have tried to cast it or eval in different ways but I am doing something wrong. 

Error in 'eval' command: Type checking failed. '*' only takes numbers.

My search command is: 

sourcetype="SpeedTest"
| eval dmbs=(download.bandwidth)*8/1000000 
| table _time download.bandwidth dmbs

And the example json is injected like this:

{ [-]
   download: { [-]
     bandwidth: 10420951
     bytes: 81587520
     elapsed: 7908
   }
   interface: { [+]
   }
   isp: Vivo
   packetLoss: 0
   ping: { [+]
   }
   result: { [+]
   }
   server: { [+]
   }
   timestamp: 2022-02-01T22:00:31Z
   type: result
   upload: { [-]
     bandwidth: 5706691
     bytes: 80526240
     elapsed: 14946
   }
}

 

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try single quotes around field names with dots in (otherwise it looks like you are trying to concatenate two strings which produces a type check error when you try to multiply the concatenated string).

sourcetype="SpeedTest"
| eval dmbs='download.bandwidth'*8/1000000 
| table _time download.bandwidth dmbs

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try single quotes around field names with dots in (otherwise it looks like you are trying to concatenate two strings which produces a type check error when you try to multiply the concatenated string).

sourcetype="SpeedTest"
| eval dmbs='download.bandwidth'*8/1000000 
| table _time download.bandwidth dmbs
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Another option is rename those fields to something without dot in their names.
0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...