Splunk Search

Why is eval failing on joined data?

laduran
Explorer

I have the following search:

 

 

index=sandbox document_type=test-collat-record-json_v2 
| where ((isnotnull(test_result)) AND project_short="LNL" AND collateral_type="fw" AND ingredient_type="ifwi_bin" AND ingredient="csme")
| dedup test_collat_record_json_guid
| join type=inner left=L right=R where L.project_short=R.project_short L.collateral_type=R.collateral_type L.ingredient_type=R.ingredient_type L.ingredient=R.ingredient
[search document_type=test-collat-record-summary-json]
| table L.collat_record_json_guid, L.project_short, L.collateral_type, L.ingredient_type, L.ingredient, L.version, L.test, L.test_result, R.number_of_tests, R.passing_threshold

 

 

I'm joining data from a set of test results and then I lookup info about what a passing set of results should look like from another data source. Hence the join. It's good. It works for me and the result yields the table:

laduran_0-1659983085885.png

So great. Just want to aggregate the results and get counts of passing/failing tests and compare that with the passing_threshold field.

So I added: 

 

 

| stats
count(eval(L.test_result=="SUCCESS")) as passingTests
count(eval(L.test_result=="FAILURE")) as failingTests
values(R.number_of_tests) as numTests,
values(R.passing_threshold) as pass_threshold
by L.collat_record_json_guid

 

 

 But the two evaluations of success and failure tests are zero. But from the table above they are clearly not zero. Should be 2 and 1 respectively.

laduran_1-1659983273155.png

What have I done wrong? Is eval not going to work on joined data? I am using the correct aliases for the data.

Labels (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this (put fields in single quotes in eval)

| stats
count(eval('L.test_result'=="SUCCESS")) as passingTests
count(eval('L.test_result'=="FAILURE")) as failingTests
values(R.number_of_tests) as numTests,
values(R.passing_threshold) as pass_threshold
by L.collat_record_json_guid

  

View solution in original post

laduran
Explorer

This fixed my issue.
Thank you! @somesoni2 

0 Karma

somesoni2
Revered Legend

Try like this (put fields in single quotes in eval)

| stats
count(eval('L.test_result'=="SUCCESS")) as passingTests
count(eval('L.test_result'=="FAILURE")) as failingTests
values(R.number_of_tests) as numTests,
values(R.passing_threshold) as pass_threshold
by L.collat_record_json_guid

  

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...