Splunk Search

help on eval

jip31
Motivator

hello
i try to use the code below but everytimes i have an issue of quote or parenthesis even if i do modifications:

| timechart span=10m eval(avg(if host=="$field1$",PercentProcessorTime,NULL)) as PercentProcessorTime_AVG by host 
OR eval(avg(if host=="$field2$",PercentProcessorTime,NULL)) as PercentProcessorTime_AVG by host 

could you help me please

Tags (1)
0 Karma
1 Solution

renjith_nair
Legend

Hi @jip31 ,
If you want to do a timechart based on host, you could simply do it by

     index="windows-wmi" sourcetype="WMI:CPUload"  host="$field1$" OR host="$field2$" (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$
      | rex field=Name "^(?<Service>[^\/]+)[\/]" 
      | eval key=Service."-".host 
      | timechart span=10m avg(PercentProcessorTime) as PercentProcessorTime BY host
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

Hi @jip31 ,
If you want to do a timechart based on host, you could simply do it by

     index="windows-wmi" sourcetype="WMI:CPUload"  host="$field1$" OR host="$field2$" (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$
      | rex field=Name "^(?<Service>[^\/]+)[\/]" 
      | eval key=Service."-".host 
      | timechart span=10m avg(PercentProcessorTime) as PercentProcessorTime BY host
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

jip31
Motivator

THANKS RENJITH

0 Karma

renjith_nair
Legend

@jip31 , again you are accepting your own answer. If one of the answer is helpful for you, please accept it or vote for it 🙂 .
@asiddique_splunk might be able to help you!

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

jip31
Motivator

Many thanks!

0 Karma

renjith_nair
Legend

@jip31 ,if the above answers your question, you shall accept it or vote it 🙂

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

jip31
Motivator

Hello i have an issue
https://www.cjoint.com/c/HGqh71VI8M0
could you help me please?

index="windows-wmi" sourcetype="WMI:CPUload"  host="$field1$" OR host="$field2$" (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$
 | rex field=Name "^(?<Service>[^\/]+)[\/]" 
 | eval key=Service."-".host 
 | timechart span=10m avg(eval(if(host=="$field1$", PercentProcessorTime, null()))) AS PercentProcessorTime_AVG1
                    avg(eval(if(host=="$field2$", PercentProcessorTime, null()))) AS PercentProcessorTime_AVG2 BY host
0 Karma

woodcock
Esteemed Legend

Did you mean to click Accept here?

0 Karma

woodcock
Esteemed Legend

Try this:

| timechart span=10m avg(eval(if(host=="$field1$", PercentProcessorTime, null()))) AS PercentProcessorTime_AVG1
                     avg(eval(if(host=="$field2$", PercentProcessorTime, null()))) AS PercentProcessorTime_AVG2 BY host
0 Karma

renjith_nair
Legend

Hi @jip31,

You need to enclose arguments of the if statement in a parenthesis like

| timechart span=10m eval(avg(if(host=="$field1$",PercentProcessorTime,NULL))) as PercentProcessorTime_AVG by host 

Reference :
https://docs.splunk.com/Documentation/Splunk/7.1.1/Search/Usestatswithevalexpressionsandfunctions#Ex...

http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Eval#2._Use_the_if_function_to_ana...

---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...