Splunk Search

Why is division via EVAL is not working?

chiennylin
New Member

My raw event is:
07 Nov 2019 01:24:49 | INFO | DispatchThread: 6119 | *** Time taken to process 100 records 1009ms | GNS-C6CAE58A-3482-451B-A7B2-6F63DE58E4B3-002 | com.dhl.ms.sdm.jms.listeners.GNSMessageListener | onMessage |

i tried to get the number of records over time

| rex "Time taken to process(?[^\_]+)records(?[^ms]+)"
| eval aveDuration =recDuration/recNum
| table recNum recDuration aveDuration _raw

but, this is not returning the aveDuration even if i use the simple eval =recDuration/recNum
my rex is correct, and i even put in convert to num but, still not working.

HELP.

thanks

0 Karma
1 Solution

mayurr98
Super Champion

try this :

| rex "Time taken to process\s+(?<recNum>\d+)\s+records\s+(?<recDuration>\d+)" 
| eval aveDuration=recDuration/recNum 
| table recNum recDuration aveDuration _raw

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try this:

... | rex "Time taken to process(?[<recNum>\d+)\s*records\s*(?<recDuration>\d+)"
| eval aveDuration = recDuration / recNum
| table recNum recDuration aveDuration _raw
0 Karma

mayurr98
Super Champion

try this :

| rex "Time taken to process\s+(?<recNum>\d+)\s+records\s+(?<recDuration>\d+)" 
| eval aveDuration=recDuration/recNum 
| table recNum recDuration aveDuration _raw
0 Karma

chiennylin
New Member

Thanks! this helps!
this is now working. will take note on the whitespace for my rex moving forward.

0 Karma

marycordova
SplunkTrust
SplunkTrust

I don't think the regex is correct, it looks like it might be capturing leading whitespace, try Time\s+taken\s+to\s+process\s+(?<recNum>\d+)\s+records\s+(?<recDuration>\d+)ms and see if it helps.

Also, this might be overkill, but I like to be explicit in my SPL so I would do the following in the eval | eval aveDuration=('recDuration'/'recNum')

@marycordova
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...