Splunk Search

Error in 'eval' type check failed

jenkinsta
Path Finder

I have a json data from file generated from the okla speedtest -f json command. I have tried to cast it or eval in different ways but I am doing something wrong. 

Error in 'eval' command: Type checking failed. '*' only takes numbers.

My search command is: 

sourcetype="SpeedTest"
| eval dmbs=(download.bandwidth)*8/1000000 
| table _time download.bandwidth dmbs

And the example json is injected like this:

{ [-]
   download: { [-]
     bandwidth: 10420951
     bytes: 81587520
     elapsed: 7908
   }
   interface: { [+]
   }
   isp: Vivo
   packetLoss: 0
   ping: { [+]
   }
   result: { [+]
   }
   server: { [+]
   }
   timestamp: 2022-02-01T22:00:31Z
   type: result
   upload: { [-]
     bandwidth: 5706691
     bytes: 80526240
     elapsed: 14946
   }
}

 

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try single quotes around field names with dots in (otherwise it looks like you are trying to concatenate two strings which produces a type check error when you try to multiply the concatenated string).

sourcetype="SpeedTest"
| eval dmbs='download.bandwidth'*8/1000000 
| table _time download.bandwidth dmbs

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try single quotes around field names with dots in (otherwise it looks like you are trying to concatenate two strings which produces a type check error when you try to multiply the concatenated string).

sourcetype="SpeedTest"
| eval dmbs='download.bandwidth'*8/1000000 
| table _time download.bandwidth dmbs
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Another option is rename those fields to something without dot in their names.
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Automated Threat Analysis: Available in ES Premier

Automated Threat Analysis: Centralize and Accelerate Phishing Investigations in Splunk Enterprise ...

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...