Why is eval failing after join?

[rakeshkiit]

index=na160 starttime="02/02/2023:00:00:00" endtime="02/02/2023:24:00:00" requestId="TID:131610985000004c2d"
|stats count as 240_COUNT by logRecordType
| join logRecordType type=outer
[search index=na160 starttime="02/08/2023:00:00:00" endtime="02/08/2023:24:00:00" requestId="TID:348627200000212ea7"
| stats count as 242_COUNT by logRecordType]
| eval difference = (242_COUNT - 240_COUNT)
| table logRecordType, 240_COUNT, 242_COUNT, difference

Above eval fails after joining two dataset 
Error in 'eval' command: The expression is malformed. 

Appreciate your help here to mitigate this issue. 

[bowesmana]

Note that using join is not good practice, as it's rarely necessary in Splunk and has limitations, which can give unpredictable results.

You can achieve the same thing using stats

index=na160 (starttime="02/02/2023:00:00:00" endtime="02/02/2023:24:00:00" requestId="TID:131610985000004c2d") OR
            (starttime="02/08/2023:00:00:00" endtime="02/08/2023:24:00:00" requestId="TID:348627200000212ea7")

| stats count(eval(requestId="TID:131610985000004c2d")) as 240_COUNT count(eval(requestId="TID:348627200000212ea7")) as 242_COUNT by logRecordType 
| eval difference = (242_COUNT - 240_COUNT)
| table logRecordType, 240_COUNT, 242_COUNT, difference

[rakeshkiit]

Given example is simplified version of query,  however in actual requestId is coming from another dataset

[bowesmana]

All good - just it's useful to not start your Splunk life with join - it's really worth getting your head around how to use stats+eval to join data sets. You will not regret it 😁 join can often lead you down a miserable path wondering why things don't do what you expect.

[bowesmana · Accepted solution]

On the right hand side of an eval statement if the field name starts with numbers or contains '.' or other non standard characters, you must wrap the field name in single quotes

| eval difference = ('242_COUNT' - '240_COUNT')