Splunk Search

Why is eval failing after join?

rakeshkiit
Engager
index=na160 starttime="02/02/2023:00:00:00" endtime="02/02/2023:24:00:00" requestId="TID:131610985000004c2d"
|stats count as 240_COUNT by logRecordType
| join logRecordType type=outer
[search index=na160 starttime="02/08/2023:00:00:00" endtime="02/08/2023:24:00:00" requestId="TID:348627200000212ea7"
| stats count as 242_COUNT by logRecordType]
| eval difference = (242_COUNT - 240_COUNT)
| table logRecordType, 240_COUNT, 242_COUNT, difference

Above eval fails after joining two dataset 
Error in 'eval' command: The expression is malformed. 

Appreciate your help here to mitigate this issue. 

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

On the right hand side of an eval statement if the field name starts with numbers or contains '.' or other non standard characters, you must wrap the field name in single quotes

| eval difference = ('242_COUNT' - '240_COUNT')

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Note that using join is not good practice, as it's rarely necessary in Splunk and has limitations, which can give unpredictable results.

You can achieve the same thing using stats

index=na160 (starttime="02/02/2023:00:00:00" endtime="02/02/2023:24:00:00" requestId="TID:131610985000004c2d") OR
            (starttime="02/08/2023:00:00:00" endtime="02/08/2023:24:00:00" requestId="TID:348627200000212ea7")

| stats count(eval(requestId="TID:131610985000004c2d")) as 240_COUNT count(eval(requestId="TID:348627200000212ea7")) as 242_COUNT by logRecordType 
| eval difference = (242_COUNT - 240_COUNT)
| table logRecordType, 240_COUNT, 242_COUNT, difference
0 Karma

rakeshkiit
Engager

Given example is simplified version of query,  however in actual requestId is coming from another dataset

0 Karma

bowesmana
SplunkTrust
SplunkTrust

All good - just it's useful to not start your Splunk life with join - it's really worth getting your head around how to use stats+eval to join data sets. You will not regret it 😁 join can often lead you down a miserable path wondering why things don't do what you expect.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

On the right hand side of an eval statement if the field name starts with numbers or contains '.' or other non standard characters, you must wrap the field name in single quotes

| eval difference = ('242_COUNT' - '240_COUNT')
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...