Splunk Search

I am trying to subtract one column from another and want to do it for other columns as well by using foreach

nkankur
Path Finder

My data is like this
Column1 Column2 Column3 Total

I am using the below command
|foreach Column* [ eval Answer <> = Total - <> ]
|table Column1, Column2, Column3 Answer1, Answer2, Answer3

but I getting the below error
Error in 'foreach' command: The last argument must be a search pipeline

alt text

Kindly Help me with this issue.

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

host=1 | tabel Column* Total
| foreach Column* [ eval Answer<<MATCHSTR>>=Total-<<FIELD>>]

View solution in original post

somesoni2
Revered Legend

Try this

host=1 | tabel Column* Total
| foreach Column* [ eval Answer<<MATCHSTR>>=Total-<<FIELD>>]

nkankur
Path Finder

I am still getting the error as given below,

No results found.

0 Karma

somesoni2
Revered Legend

Try this

host=1 | tabel Column* Total
 | foreach Column* [ | eval "Answer<<MATCHSTR>>"=Total-'<<FIELD>>']
0 Karma

nkankur
Path Finder

Thanks a lot for your support but still getting the same error.

0 Karma

somesoni2
Revered Legend

Strange. The same syntax works for me. See this runanywhere search.

| gentimes start=-1 | eval Column1=10 | eval Column2=20 | eval Column3=30 | table Column* | addtotals 
| foreach Column* [eval "Answer<<MATCHSTR>>"=Total-'<<FIELD>>']

If above works for you, please check closely if there is syntax error on your side (no extra space or anything).

0 Karma

nkankur
Path Finder

Yes your code is working just fine, but I am still stuck. I will share the code which I am using,Please guide me if there is any error in that.

When I am using below command it is showing data.

| table V* Voice

0 Karma

nkankur
Path Finder

V1 V2 V3 Voice
1000 0 0 1000
1000 0 0 1200
1000 0 0 1300

But after the below command it is showing no results.
| table V* Voice
| foreach V* [ eval "Answer<>"=Voice-'<>']

No Results

0 Karma
Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...