- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- What is the difference between these eval commands...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Heinz,
value>=" 2 " leads to some sort of string comparison instead of value>= 2 wich is the correct numerical comparison. By using " " you transform your numerical value into a string, wich messes up the equation.
Greetings
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The count(STUFF) says, if "STUFF" for this event is NOT null, then add 1 to "count". The count(eval(STUFF)) says, if "STUFF" (in this case, it must be an equation) evaluates to "true", then add 1 to "count". So in your case, it is probably not doing what you are expecting because:
These 2 are equivalent to eachother:
... | timechart span=1d count(eval(if(value>"1", value, null()))) AS count
... | timechart span=1d count(eval(value>1)) AS count
And also these 2 are equivalent to eachother:
... | timechart span=1d count(eval(if(value>="2", value, null()))) AS count
... | timechart span=1d count(eval(value>=2)) AS count
Probably what you are trying to do is something like this:
... | eval modValue=if(value>1, value, null()) | timechart span=1d sum(modValue) AS modValueSum
... | eval modValue=if(value>=2, value, null()) | timechart span=1d sum(modValue) AS modValueSum
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Heinz,
value>=" 2 " leads to some sort of string comparison instead of value>= 2 wich is the correct numerical comparison. By using " " you transform your numerical value into a string, wich messes up the equation.
Greetings
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Oh, of course. Thanks a lot!
Cheers
Heinz
PS: I think you wanted to write value>=2.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Indeed 😄 Just changed it.
Have a great day!
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
.conf24 | Personalize your .conf experience with Learning Paths!
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
