Splunk Search

I am trying to subtract one column from another and want to do it for other columns as well by using foreach

nkankur
Path Finder

My data is like this
Column1 Column2 Column3 Total

I am using the below command
|foreach Column* [ eval Answer <> = Total - <> ]
|table Column1, Column2, Column3 Answer1, Answer2, Answer3

but I getting the below error
Error in 'foreach' command: The last argument must be a search pipeline

alt text

Kindly Help me with this issue.

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

host=1 | tabel Column* Total
| foreach Column* [ eval Answer<<MATCHSTR>>=Total-<<FIELD>>]

View solution in original post

somesoni2
Revered Legend

Try this

host=1 | tabel Column* Total
| foreach Column* [ eval Answer<<MATCHSTR>>=Total-<<FIELD>>]

nkankur
Path Finder

I am still getting the error as given below,

No results found.

0 Karma

somesoni2
Revered Legend

Try this

host=1 | tabel Column* Total
 | foreach Column* [ | eval "Answer<<MATCHSTR>>"=Total-'<<FIELD>>']
0 Karma

nkankur
Path Finder

Thanks a lot for your support but still getting the same error.

0 Karma

somesoni2
Revered Legend

Strange. The same syntax works for me. See this runanywhere search.

| gentimes start=-1 | eval Column1=10 | eval Column2=20 | eval Column3=30 | table Column* | addtotals 
| foreach Column* [eval "Answer<<MATCHSTR>>"=Total-'<<FIELD>>']

If above works for you, please check closely if there is syntax error on your side (no extra space or anything).

0 Karma

nkankur
Path Finder

Yes your code is working just fine, but I am still stuck. I will share the code which I am using,Please guide me if there is any error in that.

When I am using below command it is showing data.

| table V* Voice

0 Karma

nkankur
Path Finder

V1 V2 V3 Voice
1000 0 0 1000
1000 0 0 1200
1000 0 0 1300

But after the below command it is showing no results.
| table V* Voice
| foreach V* [ eval "Answer<>"=Voice-'<>']

No Results

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...