Splunk Search

how to perform calculations using eval command?

marisstella
Explorer

Hi
I have error_codes like 4%, 5%, 6% So I want to calculate them by performing
| stats count(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount
| stats avg(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount
Any suggestions?

0 Karma

eduardKiyko
Explorer

At first, if you use both "stats count" and "stats avg" in the same search, the last expression is going to have no output, because of first one. Try to use eventstats instead.
And at second thing: I'm not sure that "avg" function will work properly with your double quotes and percent mark(maybe Splunk understands "'4%'" expression as a String, not a number). But anyway, hope, it will help:
| makeresults
| eval healthvalue="'4%'"
| eventstats count(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount
| eventstats avg(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount

0 Karma

marisstella
Explorer

Thanks for your quick reply... it is not exactly looking only for the values mentioned.. it is looking for all the key values for the field healthvalue... I want to it to look for the values which I have specified only. any one of the other clauses will help like match, like, if or any?

0 Karma

eduardKiyko
Explorer

Yes, any type of clause that works with eval according to documentation, will work, but in your case you can use "in" as well.
For example, this search will show errorcount = 0(as there are no events with healthvalue 4%):
| makeresults
| eval healthvalue="100%"
| eventstats count(eval(in(healthvalue, "4%"))) as errorcount

And this one will show errorcount = 1(one event with healthvalue 4%):
| makeresults
| eval healthvalue="4%"
| eventstats count(eval(in(healthvalue, "4%"))) as errorcount

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...