Splunk Search

Eval type error on subseach

jarrodrobins
Engager

Hi all, I'm having a few issues with using a subsearch within an eval statement.

index="capacityanalysisindex01" 
| timechart span=1d count by eventtype 
| stats avg(*) 
| eval ratio=(eventtype / ([ search index="capacityanalysisindex01" 
                                      tag::eventtype="EVENTS_PURCHASE_ALL" 
                              | stats count ]))

Running this, I receive the error:

Error in 'eval' command: Typechecking failed. '/' only takes numbers.

I'd have thought that the output of the subsearch would have been a number? If I replace it with an integer, eg, 2, the query works fine (though obviously the results are incorrect), and running the subsearch on its own produces the appropriate output; I just can't link them together.

Essentially what I'm TRYING to do is to: 1. Count up the different event types over a day. 2. Compute the average of each eventtype across each of the days. 3. Divide the averages by the total number of purchase events.

Is there a simple fix to this, or is there a better way of producing the desired results?

Thanks

Tags (2)
0 Karma

sideview
SplunkTrust
SplunkTrust

The output of the subsearch is actually count=17, not just the 17. This is because subsearches are made primarily to output searchterms into other searches.

You're not out of luck though, and you dont even have to break out the format command. Subsearches have special behavior where a) if there's only a single field and b) it's called query or search, then it will output only the value. so tack on an

| rename count as search

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...