topic Re: how to write eval inside tstats command? in Splunk Enterprise https://community.splunk.com/t5/Splunk-Enterprise/how-to-write-eval-inside-tstats-command/m-p/508108#M2490 I believe tstats does not support eval. Wed, 08 Jul 2020 14:20:23 GMT richgalloway 2020-07-08T14:20:23Z how to write eval inside tstats command? https://community.splunk.com/t5/Splunk-Enterprise/how-to-write-eval-inside-tstats-command/m-p/508057#M2485 <P>Hello,</P><P>we want to combined two fields by using eval inside the tstats where clause&nbsp;search. Please see my search below</P><P><STRONG>| tstats latest(result._time) as _time ,values(result.relational_correlationId) as relational_correlationId,values(result.tracePoint) as tracePoint,values(result.timestamp) as timestamp,values(result.content.businessFields{}.key) as content.businessFields{}.key,values(result.content.businessFields{}.value) as content.businessFields{}.value where index="hec_example1" by result.environment,result.businessGroup,result.appName,result.interfaceName,result.correlationId |rename result.environment as environment,result.businessGroup as businessGroup,result.appName as appName,result.interfaceName as interfaceName,result.correlationId as correlationId| table _time,environment,businessGroup,appName,interfaceName,tracePoint,timestamp,correlationId,content.businessFields{}.key,content.businessFields{}.value</STRONG></P><P>&nbsp;</P><P>Please help me on this.</P> Wed, 08 Jul 2020 12:15:55 GMT https://community.splunk.com/t5/Splunk-Enterprise/how-to-write-eval-inside-tstats-command/m-p/508057#M2485 nagendraDumpala 2020-07-08T12:15:55Z Re: how to write eval inside tstats command? https://community.splunk.com/t5/Splunk-Enterprise/how-to-write-eval-inside-tstats-command/m-p/508108#M2490 I believe tstats does not support eval. Wed, 08 Jul 2020 14:20:23 GMT https://community.splunk.com/t5/Splunk-Enterprise/how-to-write-eval-inside-tstats-command/m-p/508108#M2490 richgalloway 2020-07-08T14:20:23Z