Question regarding subtraction within "eval"

[aputz]

I am working on a query which indexes two indexes of data. The formats are different but I am crunching only integers from both. Below is a simplified example of my query.

index=panfw OR index=ipt | eval variable_X=if(eventtype=ALERTS,1,0) | eval variable_Y=if(eventtype=BLOCKS,1,0) | eval TOTAL=(variable_X+variable_Y) | eval DIFF=(packet_count-TOTAL) | stats sum(variable_X) sum(variable_Y) sum(DIFF) sum(packet_count) by Site

Most of the evals are tallying up the various types of logs, whether they are alerts or blocks. The issue I am seeing occurs with the statement "eval DIFF=(packet_count-TOTAL)". No errors occur and the summation which displays in the final table is the same as "sum(packet_count)", so the eval is essentially ignoring the "TOTAL" variable from the previous eval statement.

I am wondering if the eval statement is having difficulty correlating the field "packet_count" which is an integer that comes from the ipt index with the "TOTAL" variable (another integer) which was derived from a previous eval statement gathered from the panfw index. As mentioned before, outside of this subtraction issue every other part of the search string is working wonderfully.

Any help or thoughts on this is very much appreciated. Getting these two variables to play nice together and subtract is proving difficult.

[aputz]

Yes, if I remove "packet_count" from the eval for DIFF then DIFF outputs whatever the value of "TOTAL" is.

[lguinn2]

There are errors earlier in your search - as Drainy implied. Change the eval stmts / if functions and I think it will work:

index=panfw OR index=ipt | 
eval variable_X=if(eventtype=="ALERTS",1,0) | 
eval variable_Y=if(eventtype=="BLOCKS",1,0) | 
eval TOTAL=(variable_X+variable_Y) | 
eval DIFF=(packet_count-TOTAL) | 
stats sum(variable_X) sum(variable_Y) sum(DIFF) sum(packet_count) by Site

Does that help? (And do take Drainy's suggestion to debug...)

[aputz]

I tried adding the second "=" to the if statements and it doesn't fix the "eval DIFF=(packet_count-TOTAL)" from returning just the value of "packet_count".

I've used single "=" before for the eventtype checks and they have worked in the past. I know the values for variable_X, variable_Y, and TOTAL return correctly in the results. Strangely the issue only occurs between the field value "packet_count" and "TOTAL".

[Drainy]

If you cut eveything back to the TOTAL calculation, does it output a TOTAL?