Splunk Search

Eval statement not working...

msarro
Builder

For some reason the following isn't working:

index="sandbox" sourcetype="as-cdr" |stats count AS numCalls
|append [search index="sandbox" sourcetype="as-cdr" Termination_Cause="016"|stats count AS numCallsSuccessful]
|eval callSuccRate=numCallsSuccessful/numCalls
|table callSuccRate

When running the searches separately I get 134 for numCalls, and 90 for numCallsSuccessful. However when I try to evaluate them and print it to a table I get no results found. Can anyone shed some light on what I'm doing wrong?

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You would be much better off running:

index=sandbox sourcetype=as-cdr 
| stats 
    count as numCalls
    count(eval(Termination_Cause=="016")) as numCallsSuccessful
| eval callSuccRate = numCallsSuccessful/numCalls
| table callSuccRate

If your data set is very large, the subsearch will probably run into time limits. With Splunk it is generally a good idea to search the data set and retrieve data just once if possible, rather than running multiple searches or subsearches (particularly if they retrieve the same data or a subset of data).

View solution in original post

lucasdc
New Member

Hi splunkers!

I have to filter all the results of this field since 04/12/2018 until 04/12/2019 but when I do this search, it doesn't work , it comes results since from 2006!

I have tried using date time picker , but its still not working too.

How am I supposed to search? Do I have to use eval or another specific command?

Query:

index="db_archer2" earliest=-8760h latest=now()
| fields "Nome do Projeto"
| dedup "Nome do Projeto"
| eval Hoje= now()
| eval Hoje= now()-8760
| convert ctime(Hoje) ctime()
| stats dc

PS: The result was supposed to be 25 events.

Thanks!!

0 Karma

lucasdc
New Member

Hi splunkers!

I have to filter all the results of this field since 04/12/2018 until 04/12/2019 but when I do this search, it doesn't work , it comes results since from 2006!

I have tried using date time picker , but its still not working too.

How am I supposed to search? Do I have to use eval or another specific command?

Thank you friends.

![a

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You would be much better off running:

index=sandbox sourcetype=as-cdr 
| stats 
    count as numCalls
    count(eval(Termination_Cause=="016")) as numCallsSuccessful
| eval callSuccRate = numCallsSuccessful/numCalls
| table callSuccRate

If your data set is very large, the subsearch will probably run into time limits. With Splunk it is generally a good idea to search the data set and retrieve data just once if possible, rather than running multiple searches or subsearches (particularly if they retrieve the same data or a subset of data).

msarro
Builder

That actually fixed my issue, AND its a good pointer. Now I have to go and revisit some prior items I had done before 🙂 Thanks!

0 Karma

msarro
Builder

I should note I have a few reports I need to generate that use basically this same syntax. Its simple; and I can't quite figure out why its failing. Strangely I have a more complicated search that is working just fine.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...