Splunk Search

how to perform calculations using eval command?

marisstella
Explorer

Hi
I have error_codes like 4%, 5%, 6% So I want to calculate them by performing
| stats count(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount
| stats avg(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount
Any suggestions?

0 Karma

eduardKiyko
Explorer

At first, if you use both "stats count" and "stats avg" in the same search, the last expression is going to have no output, because of first one. Try to use eventstats instead.
And at second thing: I'm not sure that "avg" function will work properly with your double quotes and percent mark(maybe Splunk understands "'4%'" expression as a String, not a number). But anyway, hope, it will help:
| makeresults
| eval healthvalue="'4%'"
| eventstats count(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount
| eventstats avg(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount

0 Karma

marisstella
Explorer

Thanks for your quick reply... it is not exactly looking only for the values mentioned.. it is looking for all the key values for the field healthvalue... I want to it to look for the values which I have specified only. any one of the other clauses will help like match, like, if or any?

0 Karma

eduardKiyko
Explorer

Yes, any type of clause that works with eval according to documentation, will work, but in your case you can use "in" as well.
For example, this search will show errorcount = 0(as there are no events with healthvalue 4%):
| makeresults
| eval healthvalue="100%"
| eventstats count(eval(in(healthvalue, "4%"))) as errorcount

And this one will show errorcount = 1(one event with healthvalue 4%):
| makeresults
| eval healthvalue="4%"
| eventstats count(eval(in(healthvalue, "4%"))) as errorcount

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.