Splunk Search

Question regarding subtraction within "eval"

aputz
Path Finder

I am working on a query which indexes two indexes of data. The formats are different but I am crunching only integers from both. Below is a simplified example of my query.

index=panfw OR index=ipt | eval variable_X=if(eventtype=ALERTS,1,0) | eval variable_Y=if(eventtype=BLOCKS,1,0) | eval TOTAL=(variable_X+variable_Y) | eval DIFF=(packet_count-TOTAL) | stats sum(variable_X) sum(variable_Y) sum(DIFF) sum(packet_count) by Site

Most of the evals are tallying up the various types of logs, whether they are alerts or blocks. The issue I am seeing occurs with the statement "eval DIFF=(packet_count-TOTAL)". No errors occur and the summation which displays in the final table is the same as "sum(packet_count)", so the eval is essentially ignoring the "TOTAL" variable from the previous eval statement.

I am wondering if the eval statement is having difficulty correlating the field "packet_count" which is an integer that comes from the ipt index with the "TOTAL" variable (another integer) which was derived from a previous eval statement gathered from the panfw index. As mentioned before, outside of this subtraction issue every other part of the search string is working wonderfully.

Any help or thoughts on this is very much appreciated. Getting these two variables to play nice together and subtract is proving difficult.

Tags (3)
0 Karma

aputz
Path Finder

Yes, if I remove "packet_count" from the eval for DIFF then DIFF outputs whatever the value of "TOTAL" is.

0 Karma

lguinn2
Legend

There are errors earlier in your search - as Drainy implied. Change the eval stmts / if functions and I think it will work:

index=panfw OR index=ipt | 
eval variable_X=if(eventtype=="ALERTS",1,0) | 
eval variable_Y=if(eventtype=="BLOCKS",1,0) | 
eval TOTAL=(variable_X+variable_Y) | 
eval DIFF=(packet_count-TOTAL) | 
stats sum(variable_X) sum(variable_Y) sum(DIFF) sum(packet_count) by Site

Does that help? (And do take Drainy's suggestion to debug...)

0 Karma

aputz
Path Finder

I tried adding the second "=" to the if statements and it doesn't fix the "eval DIFF=(packet_count-TOTAL)" from returning just the value of "packet_count".

I've used single "=" before for the eventtype checks and they have worked in the past. I know the values for variable_X, variable_Y, and TOTAL return correctly in the results. Strangely the issue only occurs between the field value "packet_count" and "TOTAL".

0 Karma

Drainy
Champion

If you cut eveything back to the TOTAL calculation, does it output a TOTAL?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...