topic Re: calculation not working in Splunk Enterprise

calculation not working

sarit_s — Tue, 17 Aug 2021 10:52:07 GMT

Hello
I have this query:

sourcetype="billinglog" "Reported to MonitorProcessing successfully"| spath "AdditionalData.EventData.MetricName" | search "AdditionalData.EventData.MetricName"=DepositV2 | rename AdditionalData.EventData.monitorProcessingDto.Country as Country | search AdditionalData.EventData.monitorProcessingDto.FTD="*" | stats count(AdditionalData.EventData.monitorProcessingDto.FTD=Yes) AS FTDyes | table FTDyes

FTDyes returns as 0 while if im changing

AdditionalData.EventData.monitorProcessingDto.FTD="*"

to:

AdditionalData.EventData.monitorProcessingDto.FTD="yes"

i'm getting result 12
what am i missing ?

thanks

Re: calculation not working

ITWhisperer — Tue, 17 Aug 2021 11:14:35 GMT

Have you tried this (not sure about the case of Yes/yes since you have used it inconsistently)

| stats count(eval(AdditionalData.EventData.monitorProcessingDto.FTD="yes")) AS FTDyes

Re: calculation not working

sarit_s — Tue, 17 Aug 2021 12:49:43 GMT

Yes. it gives the same results