Splunk Search

Eval type error on subseach

jarrodrobins
Engager

Hi all, I'm having a few issues with using a subsearch within an eval statement.

index="capacityanalysisindex01" 
| timechart span=1d count by eventtype 
| stats avg(*) 
| eval ratio=(eventtype / ([ search index="capacityanalysisindex01" 
                                      tag::eventtype="EVENTS_PURCHASE_ALL" 
                              | stats count ]))

Running this, I receive the error:

Error in 'eval' command: Typechecking failed. '/' only takes numbers.

I'd have thought that the output of the subsearch would have been a number? If I replace it with an integer, eg, 2, the query works fine (though obviously the results are incorrect), and running the subsearch on its own produces the appropriate output; I just can't link them together.

Essentially what I'm TRYING to do is to: 1. Count up the different event types over a day. 2. Compute the average of each eventtype across each of the days. 3. Divide the averages by the total number of purchase events.

Is there a simple fix to this, or is there a better way of producing the desired results?

Thanks

Tags (2)
0 Karma

sideview
SplunkTrust
SplunkTrust

The output of the subsearch is actually count=17, not just the 17. This is because subsearches are made primarily to output searchterms into other searches.

You're not out of luck though, and you dont even have to break out the format command. Subsearches have special behavior where a) if there's only a single field and b) it's called query or search, then it will output only the value. so tack on an

| rename count as search

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...