Refine your search:

Trying to emulate example given here, but totals always come up zero. Basic search returns over 1,000 events for a 4 hour period, containing 4 eventcodes: 636, 637, 4732, 4733.

"ConfigMgr Remote" |chart count(Eval(EventCode="636")) AS Added, count(Eval(EventCode="637")) AS Removed

Splunk GUI returns: Specified field(s) missing from results: 'Eval(EventCode=636)', 'Eval(EventCode=637)'

Have also tried if, case, and like functions of eval (with & without quoted aurguments):

"ConfigMgr Remote" |chart count(Eval(If EventCode == "636", "1", "0")) AS Added, count(Eval(Case EventCode == "637", 1, EventCode == 4733, 1)) AS Removed, count(Eval(like, Message, "%removed%")) AS Removed2 

Answer here looks promising, but can't get bin and stats to work either.

Final goal, after I get the basic chart to work, is to change to timechart:

"ConfigMgr Remote" |timechart count(Eval(EventCode="636" OR EventCode="4732")) AS Added, count(Eval(EventCode="637" OR EventCode="4733")) AS Removed

asked 07 Dec '10, 22:01

rgcox1's gravatar image

rgcox1
8110
accept rate: 66%

edited 08 Dec '10, 00:23


One Answer:

eval() needs to be written with a lower-case e, not upper-case E. I believe the same is true of if()

link

answered 08 Dec '10, 07:10

gkanapathy's gravatar image

gkanapathy ♦
26.5k1622
accept rate: 42%

Thanks - one day maybe I'll get used to the case sensitivity almost everywhere!

(08 Dec '10, 16:16) rgcox1
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×136
×133
×63

Asked: 07 Dec '10, 22:01

Seen: 972 times

Last updated: 08 Dec '10, 07:10

Copyright © 2005-2012 Splunk, Inc. All rights reserved.