Splunk Search

Order of search ops with eval vs fieldformat

bmgilmore
Path Finder

If I run a search such as the following:

sourcetype=access_combined action=purchase | stats sum(price) as Price by product_name, productId | eval revenue="$"+tostring(Price) | fields - Price

the revenue field calculates correctly. If I structure a bit differently:

sourcetype=access_combined action=purchase | stats sum(price) as Price by product_name, productId | fieldformat revenue="$"+tostring(Price) | fields - Price

revenue does not calculate correctly ($Null), it appears that downstream operations do not work with fieldformat?

Let me know, thanks!

Tags (4)
1 Solution

jonuwz
Influencer

When you eval, revenue actually gets set to $ + whatever the value of "Price" is, so its safe to remove "Price" from the list of fields.

When you fieldformat, revenue is displayed as $ + the field known as "Price"

You then remove Price, so Price is null (i.e. revenue can not reference Price any more)

You can do fieldformat Price="$".Price instead

View solution in original post

jonuwz
Influencer

When you eval, revenue actually gets set to $ + whatever the value of "Price" is, so its safe to remove "Price" from the list of fields.

When you fieldformat, revenue is displayed as $ + the field known as "Price"

You then remove Price, so Price is null (i.e. revenue can not reference Price any more)

You can do fieldformat Price="$".Price instead

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...