Use stats with eval expressions and functions (2024)

You can embed eval expressions and functions within any of the stats functions. This is a shorthand method for creating a search without using the eval command separately from the stats command.

For example, the following search uses the eval command to filter for a specific error code. Then the stats function is used to count the distinct IP addresses.

status=* | eval dc_ip_errors=if(status=404,clientip,NULL()) | stats dc(dc_ip_errors)

As an alternative, you can embed an eval expression using eval functions in a stats function directly to return the same results. For example:

status=* | stats dc(eval(if(status=404, clientip, NULL()))) AS dc_ip_errors

Use eval expressions to count the different types of requests against each Web server

This example uses the sample data from the Search Tutorial but should work with any format of Apache web access log. To try this example on your own Splunk instance, you must download the sample data and follow the instructions to get the tutorial data into Splunk. Use the time range All time when you run the search.

Run the following search to use the stats command to determine the number of different page requests, GET and POST, that occurred for each Web server.

sourcetype=access_* | stats count(eval(method="GET")) AS GET, count(eval(method="POST")) AS POST BY host

This example uses eval expressions to specify the different field values for the stats command to count.

  • The first clause uses the count() function to count the Web access events that contain the method field value GET. Then, using the AS keyword, the field that represents these results is renamed GET.
  • The second clause does the same for POST events.
  • The counts of both types of events are then separated by the web server, using the BY clause with the host field.

The results appear on the Statistics tab and look something like this:


Use eval expressions to categorize and count fields

This example uses sample email data. You should be able to run this search on any email data by replacing the sourcetype=cisco:esa with the sourcetype value and the mailfrom field with email address field name in your data. For example, the email might be To, From, or Cc).

Find out how much of the email in your organization comes from .com, .net, .org or other top level domains.

The eval command in this search contains two expressions, separated by a comma.

sourcetype="cisco:esa" mailfrom=* | eval accountname=split(mailfrom,"@"), from_domain=mvindex(accountname,-1) | stats count(eval(match(from_domain, "[^\n\r\s]+\.com"))) AS ".com", count(eval(match(from_domain, "[^\n\r\s]+\.net"))) AS ".net", count(eval(match(from_domain, "[^\n\r\s]+\.org"))) AS ".org", count(eval(NOT match(from_domain, "[^\n\r\s]+\.(com|net|org)"))) AS "other"

  • The first part of this search uses the eval command to break up the email address in the mailfrom field. The from_domain is defined as the portion of the mailfrom field after the @ symbol.
    • The split() function is used to break the mailfrom field into a multivalue field called accountname. The first value of accountname is everything before the "@" symbol, and the second value is everything after.
    • The mvindex() function is used to set from_domain to the second value in the multivalue field accountname.
  • The results are then piped into the stats command. The stats count() function is used to count the results of the eval expression.
  • Theeval eexpression uses the match() function to compare the from_domain to a regular expression that looks for the different suffixes in the domain. If the value of from_domain matches the regular expression, the count is updated for each suffix, .com, .net, and .org. Other domain suffixes are counted as other.

The results appear on the Statistics tab and look something like this:

See also

eval command in the Search Reference
Related information
Statistical and charting functions in the Search Reference
Evaluation functions in the Search Reference
About evaluating and manipulating fields

Last modified on 11 May, 2020

Use the stats command and functionsAdd sparklines to search results

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.10, 8.1.0, 7.2.3, 8.0.8, 7.0.1, 8.0.7, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.2.0, 9.2.1, 9.2.2, 8.0.9, 8.1.1, 8.1.10

Use stats with eval expressions and functions (2024)


How to use eval in stats? ›

Understanding the eval Command

The eval command evaluates expressions and assigns the output to a field. It performs arithmetic operations, string manipulations, conditional logic, and more. With the eval command, you can create new fields or modify existing ones based on complex criteria.

What is the use of stats in Splunk? ›

The SPL2 stats command calculates aggregate statistics, such as average, count, and sum, over the incoming search results set. This is similar to SQL aggregation. If the stats command is used without a BY clause, only one row is returned, which is the aggregation over the entire incoming result set.

What does the eval function do in Splunk? ›

The eval command evaluates mathematical, string, and boolean expressions. You can chain multiple eval expressions in one search using a comma to separate subsequent expressions.

What is the function of the stats command? ›

Use this command to provide summary statistics, optionally grouped by a field. The output for this query includes one field for each of the fields specified in the query, along with one field for each aggregation.

What is an example of an eval function? ›

The Eval function evaluates the string expression and returns its value. For example, Eval("1 + 1") returns 2. If you pass to the Eval function a string that contains the name of a function, the Eval function returns the return value of the function.

How does eval () work? ›

eval() is a function property of the global object. The argument of the eval() function is a string. It will evaluate the source string as a script body, which means both statements and expressions are allowed. It returns the completion value of the code.

What do you use stats for? ›

They're used to conduct research, evaluate outcomes, develop critical thinking, and make informed decisions. Statistics can be used to inquire about almost any field of study to investigate why things happen, when they occur, and whether reoccurrence is predictable.

What is stat tool used for? ›

The Statistical Training needs Assessment Tool, also known as STAT, is a tool developed for National Statistical Offices (NSO) to assess and analyze skills gaps of staff and strategically decide on how to prioritize and meet their training needs by using different types of informal and formal learning approaches.

What is the difference between stats and eventstats in Splunk? ›

Eventstats calculates a statistical result same as stats command only difference is it does not create statistical results, it aggregates them to the original raw data. Streamstats command uses events before the current event to compute the aggregate statistics that are applied to each event.

When should I use eval? ›

It can be useful in certain situations, such as: Dynamic code evaluation: eval() can be used to evaluate code dynamically, meaning that the code is generated and executed at runtime. This can be useful when you need to generate code based on user input or other dynamic factors.

Is function better than eval? ›

Again, eval() is much slower than Function() . However, eval() is also slower than the alternatives since it has to invoke the JavaScript interpreter, while many other constructs are optimized by modern JS engines. Additionally, modern JavaScript interpreters convert JavaScript to machine code.

Why do we need eval? ›

It means, using eval function you can dynamically create python code and execute it. This can be useful in scenarios where you need to generate code based on user input or generate code for use in other applications. Despite its advantages, eval can also be a significant security risk if used improperly.

What does stats do in Splunk? ›

STATS is a Splunk search command that calculates statistics. Those statistical calculations include count, average, minimum, maximum, standard deviation, etc.

How do you use stat command? ›

The 'stat' command in Linux is a powerful tool used to display detailed information about a file or file system. It is used with the syntax, stat [options] [file. txt or /path/to/directory] . In this example, we used the 'stat' command on 'myfile.

What does stats perform do? ›

The company is involved in sports data collection and predictive analysis for use across various sports sectors including professional team performance, digital, media, broadcast and betting. The company began investing in AI in 2015.

How does model eval () work? ›

Answer: model. eval() sets the PyTorch model to evaluation mode, disabling operations like dropout, useful for inference and testing. This method plays a pivotal role in ensuring consistent and reliable model behavior during inference and testing.

How does eval command work? ›

The eval command concatenates the arguments into a single string, parses the string as a shell command line, and executes it. After executing the concatenated command line, eval returns its exit status as the exit status of eval . If there are no arguments or only empty arguments, eval returns the exit status 0 .

What is the use of eval eval used? ›

Definition. Python eval() function is used to parse an expression as an argument and then execute it within the Python program. The Python eval() is a built-in function that allows us to evaluate the Python expression as a 'string' and return the value as an integer.

Top Articles
Latest Posts
Article information

Author: Nathanial Hackett

Last Updated:

Views: 6580

Rating: 4.1 / 5 (52 voted)

Reviews: 91% of readers found this page helpful

Author information

Name: Nathanial Hackett

Birthday: 1997-10-09

Address: Apt. 935 264 Abshire Canyon, South Nerissachester, NM 01800

Phone: +9752624861224

Job: Forward Technology Assistant

Hobby: Listening to music, Shopping, Vacation, Baton twirling, Flower arranging, Blacksmithing, Do it yourself

Introduction: My name is Nathanial Hackett, I am a lovely, curious, smiling, lively, thoughtful, courageous, lively person who loves writing and wants to share my knowledge and understanding with you.