Splunk Search

I am getting the Error in 'eval' command: Type checking failed. '-' only takes numbers, while calculating difference

dtccsundar
Path Finder

Hi ,

My wish to get the difference between yesterday and todays Pass % and fail % for different sourcetypes .

I have tried as below ,

index=x1 sourcetype=y1 OR sourcetype=y2 OR sourcetype=y3 OR sourcetype=y4 OR sourcetype=y5 OR sourcetype=y6 OR sourcetype=y7 earliest=-48h@h latest=-24h@h|chart count over sourcetype by Status|addtotals|eval "dbyest Pass %"=round((Pass/Total)*100,3) |eval "dbyest Fail %"=round((Fail/Total)*100,3) |stats count by sourcetype "dbyest Pass %" "dbyest Fail %" |rename Total as "Total Scope"|eval repo="dbyest"

|append

[search index=x1 sourcetype=y1 OR sourcetype=y2 OR sourcetype=y3 OR sourcetype=y4 OR sourcetype=y5 OR sourcetype=y6 OR sourcetype=y7 earliest=-48h@h latest=-24h@h|chart count over sourcetype by Status|addtotals|eval "yest Pass %"=round((Pass/Total)*100,3) |eval "yest Fail %"=round((Fail/Total)*100,3) |stats count by sourcetype "yest Pass %" "yest Fail %" |rename Total as "Total Scope"|eval repo="yest"]

|eval "Pass % diff"=round("dbyest Pass %"-"yest Pass %")|table "dbyest Pass %" "dbyest Fail %" "yest Pass %" "yest Fail %" "Pass % diff"

When i ran this , i am getting the error "Error in 'eval' command: Type checking failed. '-' only takes numbers."

Please help me in this to get the difference ?

Labels (2)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@dtccsundar 

Can you please try this?

index=x1 sourcetype=y1 OR sourcetype=y2 OR sourcetype=y3 OR sourcetype=y4 OR sourcetype=y5 OR sourcetype=y6 OR sourcetype=y7 earliest=-48h@h latest=-24h@h 
| chart count over sourcetype by Status 
| addtotals 
| eval dbyest_Pass=round((Pass/Total)*100,3) 
| eval dbyest_Fail=round((Fail/Total)*100,3) 
| stats count by sourcetype dbyest_Pass dbyest_Fail 
| rename Total as "Total Scope" 
| eval repo="dbyest" 
| append 
    [ search index=x1 sourcetype=y1 OR sourcetype=y2 OR sourcetype=y3 OR sourcetype=y4 OR sourcetype=y5 OR sourcetype=y6 OR sourcetype=y7 earliest=-48h@h latest=-24h@h 
    | chart count over sourcetype by Status 
    | addtotals 
    | eval yest_Pass=round((Pass/Total)*100,3) 
    | eval yest_Fail=round((Fail/Total)*100,3) 
    | stats count by sourcetype yest_Pass yest_Fail 
    | rename Total as "Total Scope" 
    | eval repo="yest"] 
| eval Pass_diff=round(dbyest_Pass-yest_Pass)
| rename yest_Pass as "yest Pass %",yest_Fail as "yest Fail %", dbyest_Fail as "dbyest Fail %", dbyest_Pass as "dbyest Pass %", Pass_diff as "Pass % diff"
| table "dbyest Pass %" "dbyest Fail %" "yest Pass %" "yest Fail %" "Pass % diff"

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@dtccsundar 

Can you please change your eval with this?

| eval "Pass % diff"=round('dbyest Pass %'-'yest Pass %') 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

0 Karma

dtccsundar
Path Finder

kamlesh_vaghela  Thanks for your reply !!

But i am not seeing any value in the table command for "Pass % diff" after that .Can you please provide any other solution for this .

 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@dtccsundar 

Can you please try this?

index=x1 sourcetype=y1 OR sourcetype=y2 OR sourcetype=y3 OR sourcetype=y4 OR sourcetype=y5 OR sourcetype=y6 OR sourcetype=y7 earliest=-48h@h latest=-24h@h 
| chart count over sourcetype by Status 
| addtotals 
| eval dbyest_Pass=round((Pass/Total)*100,3) 
| eval dbyest_Fail=round((Fail/Total)*100,3) 
| stats count by sourcetype dbyest_Pass dbyest_Fail 
| rename Total as "Total Scope" 
| eval repo="dbyest" 
| append 
    [ search index=x1 sourcetype=y1 OR sourcetype=y2 OR sourcetype=y3 OR sourcetype=y4 OR sourcetype=y5 OR sourcetype=y6 OR sourcetype=y7 earliest=-48h@h latest=-24h@h 
    | chart count over sourcetype by Status 
    | addtotals 
    | eval yest_Pass=round((Pass/Total)*100,3) 
    | eval yest_Fail=round((Fail/Total)*100,3) 
    | stats count by sourcetype yest_Pass yest_Fail 
    | rename Total as "Total Scope" 
    | eval repo="yest"] 
| eval Pass_diff=round(dbyest_Pass-yest_Pass)
| rename yest_Pass as "yest Pass %",yest_Fail as "yest Fail %", dbyest_Fail as "dbyest Fail %", dbyest_Pass as "dbyest Pass %", Pass_diff as "Pass % diff"
| table "dbyest Pass %" "dbyest Fail %" "yest Pass %" "yest Fail %" "Pass % diff"

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

dtccsundar
Path Finder

Thanks for your reply KV .

I got it by changing ,

| eval "dbyest Pass %"=round((Pass/Total)*100,3)

  as 

| eval "dbyest Pass%"=round(('Pass'/Total)*100,3) 

and that worked .

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...