Splunk Search

Error in 'eval' type check failed

jenkinsta
Path Finder

I have a json data from file generated from the okla speedtest -f json command. I have tried to cast it or eval in different ways but I am doing something wrong. 

Error in 'eval' command: Type checking failed. '*' only takes numbers.

My search command is: 

sourcetype="SpeedTest"
| eval dmbs=(download.bandwidth)*8/1000000 
| table _time download.bandwidth dmbs

And the example json is injected like this:

{ [-]
   download: { [-]
     bandwidth: 10420951
     bytes: 81587520
     elapsed: 7908
   }
   interface: { [+]
   }
   isp: Vivo
   packetLoss: 0
   ping: { [+]
   }
   result: { [+]
   }
   server: { [+]
   }
   timestamp: 2022-02-01T22:00:31Z
   type: result
   upload: { [-]
     bandwidth: 5706691
     bytes: 80526240
     elapsed: 14946
   }
}

 

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try single quotes around field names with dots in (otherwise it looks like you are trying to concatenate two strings which produces a type check error when you try to multiply the concatenated string).

sourcetype="SpeedTest"
| eval dmbs='download.bandwidth'*8/1000000 
| table _time download.bandwidth dmbs

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try single quotes around field names with dots in (otherwise it looks like you are trying to concatenate two strings which produces a type check error when you try to multiply the concatenated string).

sourcetype="SpeedTest"
| eval dmbs='download.bandwidth'*8/1000000 
| table _time download.bandwidth dmbs
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Another option is rename those fields to something without dot in their names.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...