Splunk Search

Order of search ops with eval vs fieldformat

bmgilmore
Path Finder

If I run a search such as the following:

sourcetype=access_combined action=purchase | stats sum(price) as Price by product_name, productId | eval revenue="$"+tostring(Price) | fields - Price

the revenue field calculates correctly. If I structure a bit differently:

sourcetype=access_combined action=purchase | stats sum(price) as Price by product_name, productId | fieldformat revenue="$"+tostring(Price) | fields - Price

revenue does not calculate correctly ($Null), it appears that downstream operations do not work with fieldformat?

Let me know, thanks!

Tags (4)
1 Solution

jonuwz
Influencer

When you eval, revenue actually gets set to $ + whatever the value of "Price" is, so its safe to remove "Price" from the list of fields.

When you fieldformat, revenue is displayed as $ + the field known as "Price"

You then remove Price, so Price is null (i.e. revenue can not reference Price any more)

You can do fieldformat Price="$".Price instead

View solution in original post

jonuwz
Influencer

When you eval, revenue actually gets set to $ + whatever the value of "Price" is, so its safe to remove "Price" from the list of fields.

When you fieldformat, revenue is displayed as $ + the field known as "Price"

You then remove Price, so Price is null (i.e. revenue can not reference Price any more)

You can do fieldformat Price="$".Price instead

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...