Splunk Search

Failed eval command from sub search numerical results- Any suggestions?

Seawheels51
Path Finder

Hello gurus

I'm trying to return a percentage from the results of sub searches. The value User_count and Device_count are numerical but the eval returns nothing. If I convert either of the values to a number and leave the other named the eval works. Could you offer a suggestion to make this search work please? Thank you!

index="test" earliest=-2d@d latest=-1d@d
| dedup User
| stats count(User) as User_count
| append [search index="test" | stats dc(SerialNumber) as Device_count]
| eval perc=round(User_count/Device_count*100, 2)."%"
Labels (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

if you are using the same time period for both user and devices you can try this

index="test" earliest=-2d@d latest=-1d@d
| stats dc(User) as User_count dc(SerialNumber) as Device_count
| eval perc=round(User_count/Device_count*100, 2)."%"

In SPL you should almost always replace join, append* with stats. There are lot of presentation what to do it e.g.  https://conf.splunk.com/watch/conf-online.html?search=%22Nick%20Mealy%22#/ are links to Nick's "yearly" conf presentations.

r. Ismo

View solution in original post

Seawheels51
Path Finder

Thank you, that achieved the desired results! I appreciate the prompt and accurate response, well done!

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

if you are using the same time period for both user and devices you can try this

index="test" earliest=-2d@d latest=-1d@d
| stats dc(User) as User_count dc(SerialNumber) as Device_count
| eval perc=round(User_count/Device_count*100, 2)."%"

In SPL you should almost always replace join, append* with stats. There are lot of presentation what to do it e.g.  https://conf.splunk.com/watch/conf-online.html?search=%22Nick%20Mealy%22#/ are links to Nick's "yearly" conf presentations.

r. Ismo

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...