Splunk Search

Order of search ops with eval vs fieldformat

bmgilmore
Path Finder

If I run a search such as the following:

sourcetype=access_combined action=purchase | stats sum(price) as Price by product_name, productId | eval revenue="$"+tostring(Price) | fields - Price

the revenue field calculates correctly. If I structure a bit differently:

sourcetype=access_combined action=purchase | stats sum(price) as Price by product_name, productId | fieldformat revenue="$"+tostring(Price) | fields - Price

revenue does not calculate correctly ($Null), it appears that downstream operations do not work with fieldformat?

Let me know, thanks!

Tags (4)
1 Solution

jonuwz
Influencer

When you eval, revenue actually gets set to $ + whatever the value of "Price" is, so its safe to remove "Price" from the list of fields.

When you fieldformat, revenue is displayed as $ + the field known as "Price"

You then remove Price, so Price is null (i.e. revenue can not reference Price any more)

You can do fieldformat Price="$".Price instead

View solution in original post

jonuwz
Influencer

When you eval, revenue actually gets set to $ + whatever the value of "Price" is, so its safe to remove "Price" from the list of fields.

When you fieldformat, revenue is displayed as $ + the field known as "Price"

You then remove Price, so Price is null (i.e. revenue can not reference Price any more)

You can do fieldformat Price="$".Price instead

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...