Why does this newly created field (via eval) not produce any values?

[johnnydunlop]

Hi,

I have written the below search query based on some prometheus metrics being onboarded:

index=lab_openshift_prometheus sourcetype=openshift_prometheus metric_name=ceph_cluster_total_bytes | eval ceph_cluster_total_bytes_decimal = round(v,0)
| append [ search  index=lab_openshift_prometheus sourcetype=openshift_prometheus metric_name=ceph_cluster_total_used_bytes | eval ceph_cluster_total_used_bytes_decimal = round(v,0) ]
| eval aaa = ceph_cluster_total_bytes_decimal - ceph_cluster_total_used_bytes_decimal / ceph_cluster_total_bytes_decimal
| table aaa

Basically what I want to do is:
convert each metric's V field (value) from scientific notation to decimal (rounding to 2 decimal places)
Do some arithmetic on the new decimal values and create a new field based on the result

I am able to create the new decimal value fields but when I do the arithmetic on them, the new aaa field does not contain any data:

Can anyone help me with what I am doing wrong?

Thanks in advance!

[richgalloway · Accepted solution]

When the result of an eval is null it's usually because at least one of the fields in the eval is null.  In the screen shot, there are two separate events, each with one field used in the eval therefore, the eval does not have enough information to calculate aaa.

Use the stats command to combine the events then compute aaa.

index=lab_openshift_prometheus sourcetype=openshift_prometheus metric_name=ceph_cluster_total_bytes | eval ceph_cluster_total_bytes_decimal = round(v,0)
| append [ search  index=lab_openshift_prometheus sourcetype=openshift_prometheus metric_name=ceph_cluster_total_used_bytes | eval ceph_cluster_total_used_bytes_decimal = round(v,0) ]
| stats sum(*) as * 
| eval aaa = ceph_cluster_total_bytes_decimal - ceph_cluster_total_used_bytes_decimal / ceph_cluster_total_bytes_decimal
| table aaa

[johnnydunlop]

Beautiful! Thank you very much!