Splunk Search

Trying to return an event based on an eval if statement, why am I getting "Typechecking failed. The '==' operator received different types."?

maximus_reborn
Path Finder

I am calculating distance between the 2 latitude and longitude and if the distance > 0, then it will return the event or else it does not do anything. An event contains a Json message body. Following is the search I am using, but it is giving me an error.

sourcetype=SplunkRabbitMQ_messaging | spath input=msg_body | eval distance=sqrt(pow('13'-[search sourcetype=SplunkKafka_messaging | spath input=msg_body | eval lat2=pickup_latitude | return $lat2],2)+pow('5'-[search sourcetype=SplunkKafka_messaging | spath input=msg_body | eval long2=pickup_longitude | return $long2],2)) | eval result = if (distance>0, [search sourcetype=SplunkRabbitMQ_messaging | spath input=msg_body], [search sourcetype=SplunkKafka_messaging | spath input=msg_body]) | return $result

Error:

Error in 'eval' command: Typechecking failed. The '==' operator received different types.

I have to use this search in real-time.
Update: In the search , '13' & '5' are the column indexes and not the numeric value.

Tags (3)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

I'll give this a shot

[search sourcetype=SplunkRabbitMQ_messaging | spath input=msg_body | eval distance=sqrt(pow('13'-[search sourcetype=SplunkKafka_messaging | spath input=msg_body | eval lat2=pickup_latitude | return $lat2],2)+pow('5'-[search sourcetype=SplunkKafka_messaging | spath input=msg_body | eval long2=pickup_longitude | return $long2],2)) | eval sourcetype=if (distance>0, "SplunkRabbitMQ_messaging", "SplunkKafka_messaging") | table sourcetype] 
| spath input=msg_body

The subsearch (all line except last line) will return which sourcetype to use.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

I'll give this a shot

[search sourcetype=SplunkRabbitMQ_messaging | spath input=msg_body | eval distance=sqrt(pow('13'-[search sourcetype=SplunkKafka_messaging | spath input=msg_body | eval lat2=pickup_latitude | return $lat2],2)+pow('5'-[search sourcetype=SplunkKafka_messaging | spath input=msg_body | eval long2=pickup_longitude | return $long2],2)) | eval sourcetype=if (distance>0, "SplunkRabbitMQ_messaging", "SplunkKafka_messaging") | table sourcetype] 
| spath input=msg_body

The subsearch (all line except last line) will return which sourcetype to use.

maximus_reborn
Path Finder

Thanks it worked like a charm.

0 Karma

sjohnson_splunk
Splunk Employee
Splunk Employee

Run your search before the eval result and table distance. I suspect you are getting a value that is not a number.

You might also consider downloading the haversign app to do the calculation for you:

https://splunkbase.splunk.com/app/936/

0 Karma

maximus_reborn
Path Finder

Thanks I will have a look on it.

0 Karma

jkat54
SplunkTrust
SplunkTrust

You're putting integers in single quotes which is declaring them as strings, then you're trying math on strings. Do this instead:

sourcetype=SplunkRabbitMQ_messaging | spath input=msg_body | eval distance=sqrt(pow(13-[search sourcetype=SplunkKafka_messaging | spath input=msg_body | eval lat2=pickup_latitude | return $lat2],2)+pow(5-[search sourcetype=SplunkKafka_messaging | spath input=msg_body | eval long2=pickup_longitude | return $long2],2)) | eval result = if (distance>0, [search sourcetype=SplunkRabbitMQ_messaging | spath input=msg_body], [search sourcetype=SplunkKafka_messaging | spath input=msg_body]) | return $result
0 Karma

maximus_reborn
Path Finder

Sorry I have updated the question. '13' & '5' were the column indexes of sourcetype=SplunkRabbitMQ_messaging, i was referring.
Though I ran your query and it resulted in the same error.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...