title: How to evaluate a Splunk field which represents the length of another field?
body: <p>I've loaded the following example file containing lines of JSON into Splunk:</p>
  <pre class="lang-json prettyprint-override"><code>{&quot;duration&quot;:2134,&quot;input&quot;:[&quot;foo&quot;,&quot;bar&quot;],&quot;level&quot;:&quot;info&quot;,&quot;msg&quot;:&quot;Processed input&quot;,&quot;time&quot;:&quot;2022-04-07T08:10:23.14427-07:00&quot;}
  {&quot;duration&quot;:997,&quot;input&quot;:[&quot;baz&quot;],&quot;level&quot;:&quot;info&quot;,&quot;msg&quot;:&quot;Processed input&quot;,&quot;time&quot;:&quot;2022-04-07T08:10:23.144526-07:00&quot;}
  </code></pre>
  <p>Splunk has parsed these fields such that the <code>input</code> field is a list:
  <a href="https://i.stack.imgur.com/iUdVb.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/iUdVb.png" alt="enter image description here" /></a>
  I would like to generate a table of the length of (number of elements in) the input and the <code>duration</code> field. Following <a href="https://docs.splunk.com/Documentation/StreamProcessor/standard/FunctionReference/List#length.28input.29" rel="nofollow noreferrer">https://docs.splunk.com/Documentation/StreamProcessor/standard/FunctionReference/List#length.28input.29</a>, I've tried</p>
  <pre><code>msg=&quot;Processed input&quot; 
  | eval N=length(input) 
  | table N, duration
  </code></pre>
  <p>but this yields no values for <code>N</code>:</p>
  <p><a href="https://i.stack.imgur.com/hOyTe.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/hOyTe.png" alt="enter image description here" /></a></p>
  <p>What would be the correct way to determine <code>N</code>?</p>