how to perform calculations using eval command?

[marisstella]

Hi
I have error_codes like 4%, 5%, 6% So I want to calculate them by performing
| stats count(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount
| stats avg(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount
Any suggestions?

[eduardKiyko]

At first, if you use both "stats count" and "stats avg" in the same search, the last expression is going to have no output, because of first one. Try to use eventstats instead.
And at second thing: I'm not sure that "avg" function will work properly with your double quotes and percent mark(maybe Splunk understands "'4%'" expression as a String, not a number). But anyway, hope, it will help:
| makeresults
| eval healthvalue="'4%'"
| eventstats count(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount
| eventstats avg(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount

[marisstella]

Thanks for your quick reply... it is not exactly looking only for the values mentioned.. it is looking for all the key values for the field healthvalue... I want to it to look for the values which I have specified only. any one of the other clauses will help like match, like, if or any?

[eduardKiyko]

Yes, any type of clause that works with eval according to documentation, will work, but in your case you can use "in" as well.
For example, this search will show errorcount = 0(as there are no events with healthvalue 4%):
| makeresults
| eval healthvalue="100%"
| eventstats count(eval(in(healthvalue, "4%"))) as errorcount

And this one will show errorcount = 1(one event with healthvalue 4%):
| makeresults
| eval healthvalue="4%"
| eventstats count(eval(in(healthvalue, "4%"))) as errorcount