Splunk Search

Unable to use eval with stats

freephoneid
Path Finder

How do I use eval in below query to add hard coded value, say 1000 to the final count?

index=myindex | stats first(id) by uid | fields – uid | stats sum()

I tried using

index=myindex | stats first(id) by uid | fields – uid | stats eval(1000 + sum()) 

but the eval does not work with stats…

Any help is much appreciated!

Thanks!

Tags (2)
1 Solution

kristian_kolb
Ultra Champion

Hmm, not really sure about what you're trying to accomplish, but adding a static value is quite simple. Since I don't really understand your goals, I'll illustrate it with adding 1000 to the http-status value in an access_combined log.

sourcetype=access_combined | eval status=status+1000 | stats values(status) AS new_status by clientip

This results in a table like

clientip      new_status
----------------------
1.2.3.4       1404
              1200
              1503

1.2.3.5       1200
              1302

Hope this helps a little bit at least. Feel free to give more information on what you want to achieve.

UPDATE: would the following search give the same results as what you have right now, i.e. not adding the 1000?

index=myindex | stats first(id) AS temp_id by uid | stats sum(temp_id) 

in that case

index=myindex | stats first(id) AS temp_id by uid | stats sum(temp_id) AS temp_id | eval temp_id = temp_id +1000

should to the trick.

/Kristian

View solution in original post

kristian_kolb
Ultra Champion

Hmm, not really sure about what you're trying to accomplish, but adding a static value is quite simple. Since I don't really understand your goals, I'll illustrate it with adding 1000 to the http-status value in an access_combined log.

sourcetype=access_combined | eval status=status+1000 | stats values(status) AS new_status by clientip

This results in a table like

clientip      new_status
----------------------
1.2.3.4       1404
              1200
              1503

1.2.3.5       1200
              1302

Hope this helps a little bit at least. Feel free to give more information on what you want to achieve.

UPDATE: would the following search give the same results as what you have right now, i.e. not adding the 1000?

index=myindex | stats first(id) AS temp_id by uid | stats sum(temp_id) 

in that case

index=myindex | stats first(id) AS temp_id by uid | stats sum(temp_id) AS temp_id | eval temp_id = temp_id +1000

should to the trick.

/Kristian

kristian_kolb
Ultra Champion

Hi.. do want to sum up all fields. Or is it just one. Since I don't have your data to play with, I used access_combined logs with clientip and status instead of id and uid.

From what I understand in your query, your first stats command will give you two columns, and then you filter one out with the fields command. Then you just have id left.

See edit of original answer for more info.

0 Karma

freephoneid
Path Finder

hi...I want to add hard coded value 1000 to the output of the stats sum()....How can I do this? If index=myindex | stats first(id) by uid | fields – uid | stats sum() gives 500 as output then I want it to be displayed as 1500 as single value...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...