I have having trouble performing basic calculations using Eval. I can do '2*2' but I cannot do this with a count of eventtype.
I have a search running, to total EventTypes that I created.
sourcetype=csv | timechart span="1d" , count(eval(eventtype="OC-Main Player_Loaded")) AS OC-Main-player-loaded, count(eval(eventtype="OC-Main User_Interacted")) AS OC-Main-User_Interacted
This creates a table, showing the time, and then a count of the EventTypes (in this case "OC-Main PlayerLoaded" and "OC-Main UserInteracted").
I want to create a 4th column, that would give me a calculation, based on these counts. What I want is a %, but at the moment I can't get anything to work.
If I add a simple Eval at the end, the result shows. eg... | eval ocper=(2*2) shows as 4
However, if I try and use the AS event names (eg: OC-Main-player-loaded) nothing shows.
My guess is, OC-Main-player-loaded is just the name of the table column, and splunk has no concept of what I am trying to multiply. I assume I need to specify that the count should be some sort of field that can be multiplied. How do I do this?
thanks in advanced.
I would firstly try simplifying the names you are using the timechart
command, and use something simple like:
OC-Main-player-loaded --> loaded
Then pipe to your eval
command and use the simplified field labels in your calculation. I have had issues in the past with processing certain field names.
I would then pipe to rename
to change the simplified field labels to something more legible.
Hope this helps.
No problem, to close this question off, can you mark the answer as accepted with the empty tick beside the answer.
Thanks.
Ok, that works. thank you very much. It's probably something I should have tried about 4 hours ago. Instead I have been reading docs, trying examples, looking in the wiki. You live and learn! cheers!