https://community.splunk.com/t5/Splunk-Search/nested-eval-with-stats-count-not-working-while-using-Data-Model/m-p/456791#M129123 <P>I get it working by renaming the fields from "wells.resp_code" to "resp_code". I don't know why dataset name with fields not working under eval expressions.</P> Wed, 30 Sep 2020 01:11:26 GMT nagar57 2020-09-30T01:11:26Z https://community.splunk.com/t5/Splunk-Search/nested-eval-with-stats-count-not-working-while-using-Data-Model/m-p/456789#M129121 <P>Below is my query:</P> <PRE><CODE>|datamodel testing search |search wells.API="enroll" |stats count(eval(wells.resp_code="S" OR (wells.resp_code="F" AND wells.error_code="NGENR000"))) AS Success </CODE></PRE> <P>wells is the nodename and resp_code and API are extracted fields in Data Model. <BR /> When I run this query with index as a normal search query it is working, but with Data model it is not.</P> Fri, 05 Jul 2019 09:09:07 GMT https://community.splunk.com/t5/Splunk-Search/nested-eval-with-stats-count-not-working-while-using-Data-Model/m-p/456789#M129121 nagar57 2019-07-05T09:09:07Z https://community.splunk.com/t5/Splunk-Search/nested-eval-with-stats-count-not-working-while-using-Data-Model/m-p/456790#M129122 <P>Can someone help?</P> Sat, 06 Jul 2019 07:17:57 GMT https://community.splunk.com/t5/Splunk-Search/nested-eval-with-stats-count-not-working-while-using-Data-Model/m-p/456790#M129122 nagar57 2019-07-06T07:17:57Z https://community.splunk.com/t5/Splunk-Search/nested-eval-with-stats-count-not-working-while-using-Data-Model/m-p/456791#M129123 <P>I get it working by renaming the fields from "wells.resp_code" to "resp_code". I don't know why dataset name with fields not working under eval expressions.</P> Wed, 30 Sep 2020 01:11:26 GMT https://community.splunk.com/t5/Splunk-Search/nested-eval-with-stats-count-not-working-while-using-Data-Model/m-p/456791#M129123 nagar57 2020-09-30T01:11:26Z https://community.splunk.com/t5/Splunk-Search/nested-eval-with-stats-count-not-working-while-using-Data-Model/m-p/456792#M129124 <P>Hi</P> <P>look in the job inspector to see how the search is expanded<BR /> try to disable search optimization<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutoptimization">https://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutoptimization</A> <BR /> also make sure all the fields you use are defined in the datamodel or they would be filtered out<BR /> + try renaming your fields without nodename that is easier to work with with eval</P> Sat, 06 Jul 2019 09:41:35 GMT https://community.splunk.com/t5/Splunk-Search/nested-eval-with-stats-count-not-working-while-using-Data-Model/m-p/456792#M129124 maraman_splunk 2019-07-06T09:41:35Z https://community.splunk.com/t5/Splunk-Search/nested-eval-with-stats-count-not-working-while-using-Data-Model/m-p/456793#M129125 <P>It's because you removed the ".". If you wanted not rename the field you would need to add quotes around it, e.g. "wells.resp_code"="...</P> Thu, 23 Apr 2020 18:39:02 GMT https://community.splunk.com/t5/Splunk-Search/nested-eval-with-stats-count-not-working-while-using-Data-Model/m-p/456793#M129125 wgawhh5hbnht 2020-04-23T18:39:02Z