What are the limitations/benefits of using eval inside of stats commands?

[ddrillic]

One of our users is asking the following:

-- What are the limitations/benefits of using the eval command inside of the stats commands?

[DavidHourani · Accepted solution]

Hi @ddrillic,

Using an eval inside a stats commands optimizes your SPL because it allows you to run two commands in one shot.
If you take the example shown here :
https://docs.splunk.com/Documentation/Splunk/7.3.0/Search/Usetheevalcommandandfunctions#Example_1:_U....
You can see | stats count(eval(status="404")) which is the equivalent of first running an eval, finding and tagging all events with stats code 404 THEN running a count on that newly created field. With eval inside the stats it's all done in one shot which is more optimal.

As for the downside, it's only that its pretty limited and you cant use all sorts of evalexpressions inside the stats.

Let me know if that helps.

Cheers,
David

[ddrillic]

Interesting @DavidHourani.

[ddrillic]

The SE added -

-- Yeah not much to add. The difference in practice will be pretty small to be perfectly honest. Same number of events, same number of computations, but doing them together will allow for better threaded-ness and memory efficiency.

[ddrillic]

Our user asked -

-- Thanks, I was curious about the efficiency of the SPL. A lot of times the queries I run hit up against memory limits, so getting more familiar with the memory usage of SPL is getting to be more important for me. I’m pretty familiar with the actual usage/syntax of that, but wasn’t sure about the efficiency.

Following on that, I know | tstats by default does not allow nested eval expressions. Is there another way to get the efficiency benefit of nested evals inside a tstats?

[DavidHourani]

yeah, true, it can't be used for | tstats but that doesn't mean you can't run statson your tstats results and apply the eval there.

Think of tstats as a way the fetch the initial data just like calling an index, only it's way faster on accelerated data models. Once the data is there you're free to run whatever you like on it.

[ddrillic]

And the SE added -

-- There is no way to combine tstats with eval.

tstats is used to reference either a datamodel or the index metadata. If it’s a datamodel it may be worth adding the eval’d field to the datamodel if this is an important usecase.

[DavidHourani]

Exactly, and remember the lower the cardinality of your fields in the data model, the faster it will run when you accelerate it 🙂

[DavidHourani]

@ddrillic, can you please accept the answer if it was helpful ? 🙂

[ddrillic]

Sure thing @DavidHourani - thank you as always for your insights and positive energy.