Hi all, I'm having a few issues with using a subsearch within an eval statement.
index="capacityanalysisindex01"
| timechart span=1d count by eventtype
| stats avg(*)
| eval ratio=(eventtype / ([ search index="capacityanalysisindex01"
tag::eventtype="EVENTS_PURCHASE_ALL"
| stats count ]))
Running this, I receive the error:
Error in 'eval' command: Typechecking failed. '/' only takes numbers.
I'd have thought that the output of the subsearch would have been a number? If I replace it with an integer, eg, 2, the query works fine (though obviously the results are incorrect), and running the subsearch on its own produces the appropriate output; I just can't link them together.
Essentially what I'm TRYING to do is to:
1. Count up the different event types over a day.
2. Compute the average of each eventtype across each of the days.
3. Divide the averages by the total number of purchase events.
Is there a simple fix to this, or is there a better way of producing the desired results?
Thanks
... View more