Splunk Search

Why is basic eval not returning results?

jip31
Motivator

Hello

I dont understand why:
index="x" sourcetype="wmi:BatteryFull" OR sourcetype="wmi:BatteryStatic"

| dedup host
| eval Wear_Rate = 100-(FullChargedCapacity *100/DesignedCapacity)
| table host Wear_Rate

dont returns results
Could you help me please?

Tags (1)
0 Karma
1 Solution

renjith_nair
Legend

That’s because, in your last stats command you have only ‘count by host ‘ and wear_rate is not available after the stats command

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

That’s because, in your last stats command you have only ‘count by host ‘ and wear_rate is not available after the stats command

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

jip31
Motivator

many thanks renjith

0 Karma

renjith_nair
Legend

@jip31, you are welcome! If that resolves your problem, please accept this as answer.

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

jip31
Motivator

hi
I launch again a question on this topic because I have no results
When I execute the search below, I collect 3 events

eventtype=Charge
| stats first(FullChargedCapacity) AS FullChargedCapacity first(DesignedCapacity) AS DesignedCapacity first(_time) AS _time BY host 
| eval Wear_Rate = 100-(FullChargedCapacity *100/DesignedCapacity) 
| where Wear_Rate >5 
| dedup host 
| stats count

But I need to display in a single value "GOOD" OR "BAD" which depends on the wear rate value
So I do the search below but I have a "GOOD" result for the 3 events even if the wear rate is <5

eventtype=Charge AND (NOT host=E* AND NOT host=I*) 
| stats first(FullChargedCapacity) AS FullChargedCapacity first(DesignedCapacity) AS DesignedCapacity first(_time) AS _time BY host 
| eval Wear_Rate = 100-(FullChargedCapacity *100/DesignedCapacity) 
| eval FullChargedCapacity = FullChargedCapacity." mAH" 
| eval DesignedCapacity = DesignedCapacity." mAH" 
| eval Wear_Rate=round(Wear_Rate, 1) 
| where Wear_Rate >5 
| dedup host 
| stats count by host| eval Wear_Rate =if(Wear_Rate>5, "BAD", "GOOD") 
| table host Wear_Rate

What is wrong please??

0 Karma

jip31
Motivator

is anybody has an idea please??

0 Karma

Vijeta
Influencer

@jip31 Can you share some sample data? Also the field names are you seeing them in field on left hand side for FullChargedCapacity and DesignedCapacity, may be the fields are not extracted from event and thst is why your eval is not working.

0 Karma

nickhills
Ultra Champion

Your logic is sound.
This run anywhere command proves your logic:

| makeresults 1 
| eval FullChargedCapacity=4500 
| eval DesignedCapacity=4800
| eval Wear_Rate = 100-(FullChargedCapacity *100/DesignedCapacity)

Can you confirm that both the capacity fields only contain numbers (ie no mAh, or spaces etc) and that both fields are returned in any result?

Perhaps you could post the output of:

index="x" sourcetype="wmi:BatteryFull" OR sourcetype="wmi:BatteryStatic"  
 | dedup host 
 | table FullChargedCapacity DesignedCapacity
 | head 5
If my comment helps, please give it a thumbs up!
0 Karma

jip31
Motivator

you can see the output here in the question

0 Karma

renjith_nair
Legend

@jip31,

Do you have the fields FullChargedCapacity and DesignedCapacity in your search results?
Do you see them in

index="x" sourcetype="wmi:BatteryFull" OR sourcetype="wmi:BatteryStatic"  
|head 2|table host,FullChargedCapacity  , DesignedCapacity
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

jip31
Motivator

Yes I see thé events

0 Karma

renjith_nair
Legend

Are they numeric or are there are any characters together with it? Can you give me one sample data from both fields FullChargedCapacity , DesignedCapacity

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...