Splunk Search

Fields & Transforming Search Results

srw46
Path Finder

Hello all,

I am using the follow string:

*SEARCH TERM/MACROS HERE* | eval over = if (ttm_transaction_time>ttm_threshold, 1, 0) | stats sum(over) AS "Over_Threshold" count AS "Total" | eval Percentage = round (100-(Over_Threshold/Total*100),2)

The results table then displays the columns I expect i.e. :

Over_Threshold , Total , Percentage

If I then try to add another (existing) field to the results using the following string:

*SEARCH TERM/MACROS HERE* | eval over = if (ttm_transaction_time>ttm_threshold, 1, 0) | stats sum(over) AS "Over_Threshold" count AS "Total" BY ttm_transaction_id | eval Percentage = round (100-(Over_Threshold/Total*100),2)

I am expecting the results to display:

Over_Threshold , Total , ttm_transaction_id, Percentage

But instead they display

Over_Threshold , Total , ttm_transaction_id

And seem to drop the Percentage column.

Can anybody give me advice as to why this is happening or how I can change it to present the four columns I want (and possibly more)?

Tags (1)
0 Karma

srw46
Path Finder

I've now managed to solve this problem. Thanks for your guidance.

0 Karma

gordone
Explorer

Care to say what you did/tweaked?

0 Karma

srw46
Path Finder

Does anybody else have any suggestions for this issue?

I've tried umpteen ways of re-ordering the commands but to no avail.

0 Karma

hjwang
Contributor

Sounds weird, I just try this search string similiarly, and it will generate four column as expected, but by default the count by field stands as the first column

0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

The only time when eval is not going to create the result field is if any of the fields on the right hand side of the = are not present. How do your results if you remove the eval look like (the first few rows would suffice)?

0 Karma

srw46
Path Finder

Eval creates the Percentage field fine in the first example but not the second? Also, I have two eval commands, which are suggesting I remove?

0 Karma

srw46
Path Finder

I thought eval could create fields too?

Which eval should I try removing?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...