topic Re: count(failure) is returning 0 always in Splunk Search

count(failure) is returning 0 always

Jiten009 — Tue, 12 Mar 2013 17:32:21 GMT

Hi,

I am trying to find the count of total failure to calculate the failure percentage.

| stats count(eval(eventtype="failure")) AS Failed

| stats count("failure") AS Failed

In both the cases its always returning 0, whereas I have failure status count is 300 in my logs.

Please help me out in resolving this.

martin_mueller — Tue, 12 Mar 2013 17:43:18 GMT

The first stats is correct, provided you have a field named eventtype that occasionally has the value "failure".

As a different approach, try top eventtype instead of stats count.

Jiten009 — Tue, 12 Mar 2013 17:46:34 GMT

yes, I have a field in my log with name eventtype which has value failure i.e host=168.94.64.138,eventtype=Failure,facetFieldPrefix="1

Thanks for your reply.

Jiten009 — Tue, 12 Mar 2013 17:48:48 GMT

ya, got it the keyword 'Failure' in search is case sensitive.

martin_mueller — Tue, 12 Mar 2013 17:49:51 GMT

Was just about to post that 🙂

lguinn2 — Tue, 12 Mar 2013 18:28:43 GMT

This will avoid the problem of case-sensitivity:

<yourbasesearch>  eventtype="failure" | stats count

And it is probably more efficient. You should try to eliminate as many events as possible in the initial search.

BTW, search is case-insensitive for values, and that includes field values. But the stats command and the eval function are case-sensitive.