Splunk Search

Eval type error on subseach

jarrodrobins
Engager

Hi all, I'm having a few issues with using a subsearch within an eval statement.

index="capacityanalysisindex01" 
| timechart span=1d count by eventtype 
| stats avg(*) 
| eval ratio=(eventtype / ([ search index="capacityanalysisindex01" 
                                      tag::eventtype="EVENTS_PURCHASE_ALL" 
                              | stats count ]))

Running this, I receive the error:

Error in 'eval' command: Typechecking failed. '/' only takes numbers.

I'd have thought that the output of the subsearch would have been a number? If I replace it with an integer, eg, 2, the query works fine (though obviously the results are incorrect), and running the subsearch on its own produces the appropriate output; I just can't link them together.

Essentially what I'm TRYING to do is to: 1. Count up the different event types over a day. 2. Compute the average of each eventtype across each of the days. 3. Divide the averages by the total number of purchase events.

Is there a simple fix to this, or is there a better way of producing the desired results?

Thanks

Tags (2)
0 Karma

sideview
SplunkTrust
SplunkTrust

The output of the subsearch is actually count=17, not just the 17. This is because subsearches are made primarily to output searchterms into other searches.

You're not out of luck though, and you dont even have to break out the format command. Subsearches have special behavior where a) if there's only a single field and b) it's called query or search, then it will output only the value. so tack on an

| rename count as search

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...