Splunk Search

Why is my search producing error "The eval expression has no fields: 'round(on/total*100)'"?

singhh4
Path Finder

Hey people,

I have a simple search I can't get to work. I've tried to look up solutions, but couldn't find anything that worked for me.

index="servers"
|timechart count(eval(status="On")) as on count and total eval(round(on/total*100))

I keep getting this error: The eval expression has no fields: 'round(on/total*100)'

0 Karma
1 Solution

vasanthmss
Motivator

try this,

index=servers |timechart count(eval(sourcetype="splunkd")) as on , count as total | eval percent=(round(on/total*100))
V

View solution in original post

vasanthmss
Motivator

try this,

index=servers |timechart count(eval(sourcetype="splunkd")) as on , count as total | eval percent=(round(on/total*100))
V

singhh4
Path Finder

Thank you!

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Access to Splunk Observability Kubernetes “Classic Navigator” UI will no longer be available starting January ...