Why is '"foreach" ingoring some columns in the calculation?

[HeinzWaescher]

Hi,

I'm trying to calculate the ratio for all columns of a table compared to a specific column. So in the example below, just divide every column by colA. For some reason this does not work for all columns (colD is wrong), do you have any idea why?

When I decide to write the calculated values into new columns instead of replacing them, it works

Thanks in advance

[woodcock · Accepted solution]

Because you have modified colA in the middle of the work: try this:

... | eval _colA = colA | foreach * [eval <<FIELD>> = round('<<FIELD>>'/_colA*100,2)]

Fields that begin with underscores have several peculiarities, in particular these 2:
They are not shown on the 'Statisticstab (except fortime),
They are not included in wildcards for fields (which is why you need to do things likeindex=* OR index=*`).

[helge]

That remark about fields whose names begin with underscores not being included in wildcards for fields is a life-saver. Is that documented anywhere?

[cmerriman]

seems like it could be a bug to report. it looks like it's taking the replaced colA as the divisor and then multiplying by 100, leaving it with the initial value. I don't know why colB and colC aren't doing it as well, though.

to test, try creating a new column (colADup, or something) and do: |eval colADup=colA|foreach * [eval <<FIELD>>=round('<<FIELD>>'/colADup*100,2)]|fields - colADup

[HeinzWaescher]

Creating a colADup column and using it in foreach works as well. I don't get it 🙂

[cmerriman]

I think it's using the new '100' in colA in your original syntax when calculating colD, I'm just not sure why it doesn't do that for colB or colC.