Fields & Transforming Search Results

[srw46]

Hello all,

I am using the follow string:

*SEARCH TERM/MACROS HERE* | eval over = if (ttm_transaction_time>ttm_threshold, 1, 0) | stats sum(over) AS "Over_Threshold" count AS "Total" | eval Percentage = round (100-(Over_Threshold/Total*100),2)

The results table then displays the columns I expect i.e. :

Over_Threshold , Total , Percentage

If I then try to add another (existing) field to the results using the following string:

*SEARCH TERM/MACROS HERE* | eval over = if (ttm_transaction_time>ttm_threshold, 1, 0) | stats sum(over) AS "Over_Threshold" count AS "Total" BY ttm_transaction_id | eval Percentage = round (100-(Over_Threshold/Total*100),2)

I am expecting the results to display:

Over_Threshold , Total , ttm_transaction_id, Percentage

But instead they display

Over_Threshold , Total , ttm_transaction_id

And seem to drop the Percentage column.

Can anybody give me advice as to why this is happening or how I can change it to present the four columns I want (and possibly more)?

[srw46]

I've now managed to solve this problem. Thanks for your guidance.

[gordone]

Care to say what you did/tweaked?

[srw46]

Does anybody else have any suggestions for this issue?

I've tried umpteen ways of re-ordering the commands but to no avail.

[hjwang]

Sounds weird, I just try this search string similiarly, and it will generate four column as expected, but by default the count by field stands as the first column

[Ledion_Bitincka]

The only time when eval is not going to create the result field is if any of the fields on the right hand side of the = are not present. How do your results if you remove the eval look like (the first few rows would suffice)?

[srw46]

Eval creates the Percentage field fine in the first example but not the second? Also, I have two eval commands, which are suggesting I remove?

[srw46]

I thought eval could create fields too?

Which eval should I try removing?