Trying chart of multiple data series wtih tutoriel but error with eval

[echozero39]

I am tring to run a chart report followting the exemple from Search manual p.71, I get a field named "Serveur"
index="" sourcetype="" |
stats count(CPU=0) as 0_CPU avg(CPU) as avg_CPU by _time Serveur |
eval s1="CPU_0 avgCPU" |
makemv s1 | mvexpand s1|
eval yval=case(s1=="CPU_0",0_CPU,s1=="avgCPU",avg_CPU) |
eval series=Serveur+":"s1 | xyseries _time series yval

but there is an error with that eval in black, it shows "Error in 'eval' command: The expression is malformed. Expected )", but I just can't find where I missed the ")". Thanks for helping me.

[echozero39]

either

index="" sourcetype="" | 
  stats count(eval(CPU="0")) as 0_CPU avg(CPU) as avg_CPU by _time Serveur | 
  eval s1="CPU_0 avgCPU" | 
  makemv s1 | mvexpand s1| 
  eval yval=case(s1=="CPU_0",0_CPU,s1=="avgCPU",avg_CPU) | 
  eval series=Serveur+":"+s1 | xyseries _time series yval

or

 index="" sourcetype="" | 
  stats count(CPU=0) as 0_CPU avg(CPU) as avg_CPU by _time Serveur | 
  eval s1="CPU_0 avgCPU" | 
  makemv s1 | mvexpand s1| 
  eval yval=case(s1=="CPU_0",0_CPU,s1=="avgCPU",avg_CPU) | 
  eval series=Serveur+":"+s1 | xyseries _time series yval

both having error : Error in 'eval' command: The expression is malformed. Expected ).

Maybe it's a version issue ? I am using 6.2.2, the search manual is 6.3.2

[hmozaffari]

I still see double quotes missing. I ran the following on 6.2.2 and didn`t get any error:

index="" sourcetype="" | 
   stats count(CPU=0) as 0_CPU avg(CPU) as avg_CPU by _time Serveur | 
   eval s1="CPU_0 avgCPU" | 
   makemv s1 | mvexpand s1| 
   eval yval=case(s1=="CPU_0","0_CPU",s1=="avgCPU","avg_CPU") | 
   eval series=Serveur+":"+s1 | xyseries _time series yval

eval yval=case(s1=="CPU_0","0_CPU",s1=="avgCPU","avg_CPU") |

[echozero39]

that ran without error, but I didn't get the result I want.

In fact, I want to be able to ran this :
index=* sourcetype=* | timechart count(CPU=0) avg(CPU) by Serveur

However, timechart does not support multiple data series, and the exmple of The Search manual shows that I can run a similar search,

this is the original search from the document :
index=application_servers | stats sum(handledRequests) as hRs,
avg(sessions) as ssns by _time,source | eval s1="handledReqs sessions"
| makemv s1 | mvexpand s1 | eval
yval=case(s1=="handledReqs",hRs,s1=="sessions",ssns) | eval
series=source+":"+s1 | xyseries _time,series,yval

I changed it but my search didn't work :
index=* sourcetype="*" |
stats count(CPU=0) as 0_CPU avg(CPU) as avg_CPU by _time Serveur |
eval s1="CPU_0 avgCPU" |
makemv s1 | mvexpand s1|
eval yval=case(s1=="CPU_0",0_CPU,s1=="avgCPU",avg_CPU) |
eval series=Serveur+":"+s1 | xyseries _time series yval

Can you help me find out the reason ? Thank you in advance !

[stephanefotso]

OK. I think the problem is that 0_CPU. The name of the field is incorect. It must not start with a digit. Change the name of that field and use for example nulcpu.

index="" sourcetype="" | 
   stats count(eval(CPU="0")) as nulcpu avg(CPU) as avg_CPU by _time Serveur | 
   eval s1="CPU_0 avgCPU" | 
   makemv s1 | mvexpand s1| 
   eval yval=case(s1=="CPU_0",nulcpu,s1=="avgCPU",avg_CPU) | 
   eval series=Serveur+":"+s1 | xyseries _time series yval

I'm sure it will work now.
Thanks.

[echozero39]

thank you so much, that one works...

[stephanefotso]

The answer to accept is the one bellow. I did not received any point

[stephanefotso · Accepted solution]

Hello!n I think the error is here: eval series=Serveur+":"s1. Here is what to write: eval series=Serveur+":"+s1
Thanks

[echozero39]

Thanks for your answer, that was a mistake occurred when I typed the question
The problem is the eval in black anyway,

in fact I did test without the last line and it gave me always:

Error in 'eval' command: The expression is malformed. Expected ).

😞

[stephanefotso]

Here you go:

index="" sourcetype="" | 
stats count(eval(CPU="0")) as 0_CPU avg(CPU) as avg_CPU by _time Serveur | 
eval s1="CPU_0 avgCPU" | 
makemv s1 | mvexpand s1| 
eval yval=case(s1=="CPU_0",0_CPU,s1=="avgCPU",avg_CPU) | 
eval series=Serveur+":"+s1 | xyseries _time series yval

[echozero39]

Thanks again !
But It doesn't work, always the same error.

this eval make the whole command goes wrong : eval yval=case(s1=="CPU_0",0_CPU,s1=="avgCPU",avg_CPU

[hmozaffari]

You forgot to enclose them with double quote :

eval yval=case(s1="CPU_0","0_CPU",s1="avgCPU","avg_CPU")

[echozero39]

That's a copy/paste issue..

index="" sourcetype="" | 
 stats count(eval(CPU="0")) as 0_CPU avg(CPU) as avg_CPU by _time Serveur | 
 eval s1="CPU_0 avgCPU" | 
 makemv s1 | mvexpand s1| 
 eval yval=case(s1=="CPU_0",0_CPU,s1=="avgCPU",avg_CPU) | 
 eval series=Serveur+":"+s1 | xyseries _time series yval

and

index="" sourcetype="" | 
 stats count(CPU=0) as 0_CPU avg(CPU) as avg_CPU by _time Serveur | 
 eval s1="CPU_0 avgCPU" | 
 makemv s1 | mvexpand s1| 
 eval yval=case(s1=="CPU_0",0_CPU,s1=="avgCPU",avg_CPU) | 
 eval series=Serveur+":"+s1 | xyseries _time series yval

both not working in my splunk

[stephanefotso]

OK. I think the problem is that 0_CPU. The name of the field is incorect.. It must not start with a digit. Change the name of that field and use for example nulcpu.

 index="" sourcetype="" | 
  stats count(eval(CPU="0")) as nulcpu avg(CPU) as avg_CPU by _time Serveur | 
  eval s1="CPU_0 avgCPU" | 
  makemv s1 | mvexpand s1| 
  eval yval=case(s1=="CPU_0",nulcpu,s1=="avgCPU",avg_CPU) | 
  eval series=Serveur+":"+s1 | xyseries _time series yval

I'm sure it will work now.
Thanks.