Splunk Search

how to perform calculations using eval command?

marisstella
Explorer

Hi
I have error_codes like 4%, 5%, 6% So I want to calculate them by performing
| stats count(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount
| stats avg(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount
Any suggestions?

0 Karma

eduardKiyko
Explorer

At first, if you use both "stats count" and "stats avg" in the same search, the last expression is going to have no output, because of first one. Try to use eventstats instead.
And at second thing: I'm not sure that "avg" function will work properly with your double quotes and percent mark(maybe Splunk understands "'4%'" expression as a String, not a number). But anyway, hope, it will help:
| makeresults
| eval healthvalue="'4%'"
| eventstats count(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount
| eventstats avg(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount

0 Karma

marisstella
Explorer

Thanks for your quick reply... it is not exactly looking only for the values mentioned.. it is looking for all the key values for the field healthvalue... I want to it to look for the values which I have specified only. any one of the other clauses will help like match, like, if or any?

0 Karma

eduardKiyko
Explorer

Yes, any type of clause that works with eval according to documentation, will work, but in your case you can use "in" as well.
For example, this search will show errorcount = 0(as there are no events with healthvalue 4%):
| makeresults
| eval healthvalue="100%"
| eventstats count(eval(in(healthvalue, "4%"))) as errorcount

And this one will show errorcount = 1(one event with healthvalue 4%):
| makeresults
| eval healthvalue="4%"
| eventstats count(eval(in(healthvalue, "4%"))) as errorcount

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...