Eval command vs eval expression

Viewed 387

It seems that there is a difference between eval command and eval expression:

Eval command:

eval velocity=distance/time

Eval expression:

stats count(eval(status=404)) AS status_count

Notice that in the case of the expression eval is used as a function with parentheses around the arguments. I found documentation for the eval command: https://docs.splunk.com/Documentation/Splunk/8.2.3/SearchReference/Eval

Is there documentation for the eval expression?

1 Answers

Any time you find something lacking in Splunk's documentation you should submit feedback on the relevant page (perhaps https://docs.splunk.com/Documentation/Splunk/8.2.3/SearchReference/Stats). Splunk is excellent about updating their docs in response to user feedback.

The principal difference between eval as a command and eval as a function is the former assigns a value to a field (potentially also creating that field) whereas the latter returns a value to the outer function (there must always be an outer function). Using eval with stats allows for more flexibility in what stats calculates.

Related