×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
rakeshkiit
Engager
Member since: ‎02-09-2023
‎02-10-2023
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎02-09-2023
Activity Feed
Topics I've Started
View All

Re: Eval failing after join

by in Splunk Search
‎02-09-2023 10:27 PM
‎02-09-2023 10:27 PM
Given example is simplified version of query,  however in actual requestId is coming from another dataset ... View more

Why is eval failing after join?

by in Splunk Search
‎02-09-2023 09:11 PM
‎02-09-2023 09:11 PM
index=na160 starttime="02/02/2023:00:00:00" endtime="02/02/2023:24:00:00" requestId="TID:131610985000004c2d" |stats count as 240_COUNT by logRecordType | join logRecordType type=outer [search index=na160 starttime="02/08/2023:00:00:00" endtime="02/08/2023:24:00:00" requestId="TID:348627200000212ea7" | stats count as 242_COUNT by logRecordType] | eval difference = (242_COUNT - 240_COUNT) | table logRecordType, 240_COUNT, 242_COUNT, difference Above eval fails after joining two dataset  Error in 'eval' command: The expression is malformed.  Appreciate your help here to mitigate this issue.  ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎02-10-2023 03:26 PM