topic Re: Why am I not getting value in a new created field? in Splunk Search

Why am I not getting value in a new created field?

csharm21 — Tue, 08 Jan 2019 07:08:15 GMT

Hi Team,

I am trying to create one SPL search and create a new field with the eval command, but I am not getting any value count on the newly created field.

Please find my query below.

index=throwaway sourcetype=GIC-EMR-Wrapper-log_V1
| stats 
count(eval(errorResponse.ResponseCode=CCEABR)) as "CCEABR Count"
count(eval(errorResponse.ResponseCode=CCEAIT)) as "CCEAIT Count"
count(eval(errorResponse.ResponseCode=CCEAEE)) as "CCEAEE Count" 
count(eval(errorResponse.ResponseCode=AESCND)) as "AESCND Count" 
count(eval(errorResponse.ResponseCode=AESCEE)) as "AESCEE Count" 
count(eval(errorResponse.ResponseCode=AERCEE)) as "AERCEE Count" 
count(eval(errorResponse.ResponseCode=CPDNA)) as "CPDNA Count"
count(eval(errorResponse.ResponseCode=CPMNF)) as "CPMNF Count"
count(eval(errorResponse.ResponseCode=CPLOB)) as "CPLOB Count"
count(eval(isnull(errorResponse.TimeStamp))) as "Timeout Count"
count(eval(errorResponse.JsonResponse="" or isnull(errorResponse.JsonResponse))) as "Success/No Error Code Count"
by requestSpecificElements.clientID requestSpecificElements.locationID
| rename requestSpecificElements.clientID as "Client ID"
requestSpecificElements.locationID as "Location ID

Re: Why am I not getting value in a new created field?

kamlesh_vaghela — Tue, 08 Jan 2019 07:36:59 GMT

@csharm21

Can you please make sure below points?

1) Check whether all field available... Mainly those which are in by clause.
index=throwaway sourcetype=GIC-EMR-Wrapper-log_V1 | table errorResponse.*
2) Try with Enclosing filed name value with quotes. like count(eval("errorResponse.ResponseCode"="CCEABR")) as "CCEABR Count" &
from requestSpecificElements.clientID to "requestSpecificElements.clientID"

Re: Why am I not getting value in a new created field?

csharm21 — Tue, 08 Jan 2019 07:51:44 GMT

Hi Kamlesh,

Even if i run
index=throwaway sourcetype=GIC-EMR-Wrapper-log_V1 | stats count(eval("errorResponse.ResponseCode"="CCEABR")) as "CCEABR Count"

I get only 0 count

but if i use i get some output like below.
index=throwaway sourcetype=GIC-EMR-Wrapper-log_V1 errorResponse.ResponseCode="*" |stats count by errorResponse.ResponseCode

errorResponse.ResponseCode count
CCEAIT 2
CPLOB 3
null 6

Re: Why am I not getting value in a new created field?

niketn — Tue, 08 Jan 2019 08:05:54 GMT

@csharm21 add single quote for your field name inside eval expression as there is dot ( . ) special character in the field name. Try replacing stats pipe with the following ans confirm!

| stats 
count(eval('errorResponse.ResponseCode'=="CCEABR")) as "CCEABR Count"
count(eval('errorResponse.ResponseCode'=="CCEAIT")) as "CCEAIT Count"
count(eval('errorResponse.ResponseCode'=="CCEAEE")) as "CCEAEE Count" 
count(eval('errorResponse.ResponseCode'=="AESCND")) as "AESCND Count" 
count(eval('errorResponse.ResponseCode'=="AESCEE")) as "AESCEE Count" 
count(eval('errorResponse.ResponseCode'=="AERCEE")) as "AERCEE Count" 
count(eval('errorResponse.ResponseCode'=="CPDNA")) as "CPDNA Count"
count(eval('errorResponse.ResponseCode'=="CPMNF")) as "CPMNF Count"
count(eval('errorResponse.ResponseCode'=="CPLOB")) as "CPLOB Count"
count(eval(isnull('errorResponse.TimeStamp'))) as "Timeout Count"
count(eval('errorResponse.JsonResponse'=="" or isnull('errorResponse.JsonResponse'))) as "Success/No Error Code Count"
by "requestSpecificElements.clientID" "requestSpecificElements.locationID"

Re: Why am I not getting value in a new created field?

csharm21 — Tue, 08 Jan 2019 09:32:50 GMT

Thanks @niketnilay this worked for me.