Turn on suggestions

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

Splunk Search

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

- Community
- :
- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- What is the eval command doing in this search?

- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page

Highlighted

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

nagarjuna280

Communicator

11-27-2016
01:37 AM

`|stats count(eval(method="GET")) as get`

. Can someone explain this example clearly? What is `eval`

doing here?

1 Solution

Highlighted

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

martin_mueller

SplunkTrust

11-27-2016
02:37 AM

`count(eval())`

is testing the boolean expression inside the `eval()`

and only counting those events that yield true, ie those with `method="GET"`

.

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: What is the eval command doing in this search?

ddrillic

Ultra Champion

11-27-2016
03:01 PM

The manual explains it at Use stats with eval expressions and functions

One example there is -

```
status=404 | stats dc(eval(if(status=404, ip, NULL))) AS dc_ip
```

your `method="GET"`

is a shortcut for the `if(method="GET",1,0)`

command.

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: What is the eval command doing in this search?

nagarjuna280

Communicator

11-28-2016
10:14 AM

|eval newitem=if(status=404, ip, null)

it returns "ip"

then we can use | stats dc(newItem).

what does eval do after returning an argument (ip). like |stats dc(eval(ip))

meaning of eval(ip) ?

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: What is the eval command doing in this search?

martin_mueller

SplunkTrust

11-28-2016
10:18 AM

`| stats dc(eval(ip))`

is the same as `| stats dc(ip)`

.

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: What is the eval command doing in this search?

nagarjuna280

Communicator

11-28-2016
10:29 AM

what does eval(ip) return?

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: What is the eval command doing in this search?

martin_mueller

SplunkTrust

11-28-2016
10:37 AM

`eval(ip)`

evaluates the expression `ip`

, so it returns `ip`

.

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: What is the eval command doing in this search?

nagarjuna280

Communicator

11-28-2016
10:56 AM

as you said "| stats dc(eval(ip)) is the same as | stats dc(ip)"

if(method="GET", 0 ,1) return 0 or 1

then dc(eval(0)) should be same as dc (0)

sourcetype=access*combined* |stats dc(eval(if(method="GET", 0 ,1))) as dc*method

should be same as sourcetype=access*combined* |stats dc(if(method="GET", 0 ,1)) as dc*method

but not showing 0 results (last one)

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: What is the eval command doing in this search?

nagarjuna280

Communicator

11-28-2016
11:03 AM

as you said "| stats dc(eval(ip)) is the same as | stats dc(ip)"

if(method="GET", 0 ,1) return 0 or 1

then dc(eval(0)) should be same as dc (0)

sourcetype=access*combined* |stats dc(eval(if(method="GET", 0 ,1))) as dc*method

giving 2 as count

should be same as sourcetype=access*combined* |stats dc(if(method="GET", 0 ,1)) as dc*method

0 as count

but showing 0 results (last one)

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: What is the eval command doing in this search?

martin_mueller

SplunkTrust

11-28-2016
11:24 AM

That's because in the first case, there's an `eval()`

function to evaluate the `if()`

expression, while in the second case there isn't.

`eval(if(method="GET", 0, 1))`

evaluates to 0 if the method is GET, to 1 otherwise.