Splunk Search

I am trying to subtract one column from another and want to do it for other columns as well by using foreach

nkankur
Path Finder

My data is like this
Column1 Column2 Column3 Total

I am using the below command
|foreach Column* [ eval Answer <> = Total - <> ]
|table Column1, Column2, Column3 Answer1, Answer2, Answer3

but I getting the below error
Error in 'foreach' command: The last argument must be a search pipeline

alt text

Kindly Help me with this issue.

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

host=1 | tabel Column* Total
| foreach Column* [ eval Answer<<MATCHSTR>>=Total-<<FIELD>>]

View solution in original post

somesoni2
Revered Legend

Try this

host=1 | tabel Column* Total
| foreach Column* [ eval Answer<<MATCHSTR>>=Total-<<FIELD>>]

nkankur
Path Finder

I am still getting the error as given below,

No results found.

0 Karma

somesoni2
Revered Legend

Try this

host=1 | tabel Column* Total
 | foreach Column* [ | eval "Answer<<MATCHSTR>>"=Total-'<<FIELD>>']
0 Karma

nkankur
Path Finder

Thanks a lot for your support but still getting the same error.

0 Karma

somesoni2
Revered Legend

Strange. The same syntax works for me. See this runanywhere search.

| gentimes start=-1 | eval Column1=10 | eval Column2=20 | eval Column3=30 | table Column* | addtotals 
| foreach Column* [eval "Answer<<MATCHSTR>>"=Total-'<<FIELD>>']

If above works for you, please check closely if there is syntax error on your side (no extra space or anything).

0 Karma

nkankur
Path Finder

Yes your code is working just fine, but I am still stuck. I will share the code which I am using,Please guide me if there is any error in that.

When I am using below command it is showing data.

| table V* Voice

0 Karma

nkankur
Path Finder

V1 V2 V3 Voice
1000 0 0 1000
1000 0 0 1200
1000 0 0 1300

But after the below command it is showing no results.
| table V* Voice
| foreach V* [ eval "Answer<>"=Voice-'<>']

No Results

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...