https://community.splunk.com/t5/Splunk-Search/help-with-tstats-and-eval/m-p/454614#M128608 <P>Like this:</P> <PRE><CODE>|tstats count WHERE index=cisco AND sourcetype="cisco:asa" BY splunk_server _time span=1d | eval splunk_region = case( like(splunk_server,"%bos-%"), "BOS", like(splunk_server, "dfw-%"), "DFW", like(splunk_server, "%lax-%"), "LAX", true(), "OTHER") | timechart span=1d sum(count) AS count BY splunk_region </CODE></PRE> Tue, 20 Aug 2019 15:21:33 GMT woodcock 2019-08-20T15:21:33Z https://community.splunk.com/t5/Splunk-Search/help-with-tstats-and-eval/m-p/454613#M128607 <P>Hi,</P> <P>I'm trying to count the number of events for a specific index/sourcetype combo, and then total them into a new field, using eval. I've tried this, but looks like my logic is off, as the numbers are very weird - looks like it's counting the number of splunk servers. I want to count the number of events per splunk_server and then total them into a new field named splunk_region.</P> <PRE><CODE>|tstats count WHERE index=cisco AND sourcetype="cisco:asa" by splunk_server _time | eval splunk_region = case(like(splunk_server,"%bos-%"),"BOS" , like(splunk_server, "dfw-%"),"DFW", like(splunk_server, "%lax-%"), "LAX", like(splunk_server, "%"),"OTHER") | timechart span=1d count by splunk_region </CODE></PRE> Wed, 30 Sep 2020 01:48:20 GMT https://community.splunk.com/t5/Splunk-Search/help-with-tstats-and-eval/m-p/454613#M128607 a212830 2020-09-30T01:48:20Z https://community.splunk.com/t5/Splunk-Search/help-with-tstats-and-eval/m-p/454614#M128608 <P>Like this:</P> <PRE><CODE>|tstats count WHERE index=cisco AND sourcetype="cisco:asa" BY splunk_server _time span=1d | eval splunk_region = case( like(splunk_server,"%bos-%"), "BOS", like(splunk_server, "dfw-%"), "DFW", like(splunk_server, "%lax-%"), "LAX", true(), "OTHER") | timechart span=1d sum(count) AS count BY splunk_region </CODE></PRE> Tue, 20 Aug 2019 15:21:33 GMT https://community.splunk.com/t5/Splunk-Search/help-with-tstats-and-eval/m-p/454614#M128608 woodcock 2019-08-20T15:21:33Z