Splunk Search

I am trying to subtract one column from another and want to do it for other columns as well by using foreach

nkankur
Path Finder

My data is like this
Column1 Column2 Column3 Total

I am using the below command
|foreach Column* [ eval Answer <> = Total - <> ]
|table Column1, Column2, Column3 Answer1, Answer2, Answer3

but I getting the below error
Error in 'foreach' command: The last argument must be a search pipeline

alt text

Kindly Help me with this issue.

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

host=1 | tabel Column* Total
| foreach Column* [ eval Answer<<MATCHSTR>>=Total-<<FIELD>>]

View solution in original post

somesoni2
Revered Legend

Try this

host=1 | tabel Column* Total
| foreach Column* [ eval Answer<<MATCHSTR>>=Total-<<FIELD>>]

nkankur
Path Finder

I am still getting the error as given below,

No results found.

0 Karma

somesoni2
Revered Legend

Try this

host=1 | tabel Column* Total
 | foreach Column* [ | eval "Answer<<MATCHSTR>>"=Total-'<<FIELD>>']
0 Karma

nkankur
Path Finder

Thanks a lot for your support but still getting the same error.

0 Karma

somesoni2
Revered Legend

Strange. The same syntax works for me. See this runanywhere search.

| gentimes start=-1 | eval Column1=10 | eval Column2=20 | eval Column3=30 | table Column* | addtotals 
| foreach Column* [eval "Answer<<MATCHSTR>>"=Total-'<<FIELD>>']

If above works for you, please check closely if there is syntax error on your side (no extra space or anything).

0 Karma

nkankur
Path Finder

Yes your code is working just fine, but I am still stuck. I will share the code which I am using,Please guide me if there is any error in that.

When I am using below command it is showing data.

| table V* Voice

0 Karma

nkankur
Path Finder

V1 V2 V3 Voice
1000 0 0 1000
1000 0 0 1200
1000 0 0 1300

But after the below command it is showing no results.
| table V* Voice
| foreach V* [ eval "Answer<>"=Voice-'<>']

No Results

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...