Hi,
I'm doing some search query where I used timechart command that creates fields. Now, what I want to do is to some calculations with this fields using eval command but nothing happens.
Here's my query:
index="sample_data" sourcetype="management_sampledata.csv"
| timechart count(Ticket_No) as Inflow
| append
[search index="sample_data" sourcetype="management_sampledata.csv" Status=Closed
| timechart count(Ticket_No) as Closed/Cancelled
| fillnull]
| timechart first(*) as *
| eval Backlog_Total = (Inflow-Closed/Cancelled)
And here's the result:
What I was expecting to happen is a new field named "Backlog_Total" will be created using the eval command.
I hope someone can help me with this.
Thank you.
Hi
Can you please try this?
index="sample_data" sourcetype="management_sampledata.csv"
| timechart count(Ticket_No) as Inflow
| append
[search index="sample_data" sourcetype="management_sampledata.csv" Status=Closed
| timechart count(Ticket_No) as "Closed/Cancelled"
| fillnull]
| timechart first(*) as *
| eval Backlog_Total = (Inflow-'Closed/Cancelled')
I have just changed in Closed/Cancelled
field.
Thanks
Hi
Can you please try this?
index="sample_data" sourcetype="management_sampledata.csv"
| timechart count(Ticket_No) as Inflow
| append
[search index="sample_data" sourcetype="management_sampledata.csv" Status=Closed
| timechart count(Ticket_No) as "Closed/Cancelled"
| fillnull]
| timechart first(*) as *
| eval Backlog_Total = (Inflow-'Closed/Cancelled')
I have just changed in Closed/Cancelled
field.
Thanks
Hi @kamlesh_vaghela,
It works!
Thank you again. 🙂
Glad to help you.
Can you please accept the answer to close this question and upvote any comment which helps you.
Happy Splunking