index=na160 starttime="02/02/2023:00:00:00" endtime="02/02/2023:24:00:00" requestId="TID:131610985000004c2d"
|stats count as 240_COUNT by logRecordType
| join logRecordType type=outer
[search index=na160 starttime="02/08/2023:00:00:00" endtime="02/08/2023:24:00:00" requestId="TID:348627200000212ea7"
| stats count as 242_COUNT by logRecordType]
| eval difference = (242_COUNT - 240_COUNT)
| table logRecordType, 240_COUNT, 242_COUNT, difference
Above eval fails after joining two dataset
Error in 'eval' command: The expression is malformed.
Appreciate your help here to mitigate this issue.
On the right hand side of an eval statement if the field name starts with numbers or contains '.' or other non standard characters, you must wrap the field name in single quotes
| eval difference = ('242_COUNT' - '240_COUNT')
Note that using join is not good practice, as it's rarely necessary in Splunk and has limitations, which can give unpredictable results.
You can achieve the same thing using stats
index=na160 (starttime="02/02/2023:00:00:00" endtime="02/02/2023:24:00:00" requestId="TID:131610985000004c2d") OR
(starttime="02/08/2023:00:00:00" endtime="02/08/2023:24:00:00" requestId="TID:348627200000212ea7")
| stats count(eval(requestId="TID:131610985000004c2d")) as 240_COUNT count(eval(requestId="TID:348627200000212ea7")) as 242_COUNT by logRecordType
| eval difference = (242_COUNT - 240_COUNT)
| table logRecordType, 240_COUNT, 242_COUNT, difference
Given example is simplified version of query, however in actual requestId is coming from another dataset
All good - just it's useful to not start your Splunk life with join - it's really worth getting your head around how to use stats+eval to join data sets. You will not regret it 😁 join can often lead you down a miserable path wondering why things don't do what you expect.
On the right hand side of an eval statement if the field name starts with numbers or contains '.' or other non standard characters, you must wrap the field name in single quotes
| eval difference = ('242_COUNT' - '240_COUNT')