https://community.splunk.com/t5/Splunk-Search/SPL/m-p/530197#M149800 <P>Hello ,</P><P>I am not getting any result while executing below query. Can you please help me to know what i am doing wrong with the eval command with if condition below.</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="IMG_20201119_221004.jpg" style="width: 4000px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/12001iAA5599E0FE02CDD1/image-size/medium?v=v2&amp;px=400" role="button" title="IMG_20201119_221004.jpg" alt="IMG_20201119_221004.jpg" /></span></P><P> </P><P><SPAN> </SPAN></P> Fri, 20 Nov 2020 11:57:47 GMT uagraw01 2020-11-20T11:57:47Z https://community.splunk.com/t5/Splunk-Search/SPL/m-p/530197#M149800 <P>Hello ,</P><P>I am not getting any result while executing below query. Can you please help me to know what i am doing wrong with the eval command with if condition below.</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="IMG_20201119_221004.jpg" style="width: 4000px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/12001iAA5599E0FE02CDD1/image-size/medium?v=v2&amp;px=400" role="button" title="IMG_20201119_221004.jpg" alt="IMG_20201119_221004.jpg" /></span></P><P> </P><P><SPAN> </SPAN></P> Fri, 20 Nov 2020 11:57:47 GMT https://community.splunk.com/t5/Splunk-Search/SPL/m-p/530197#M149800 uagraw01 2020-11-20T11:57:47Z https://community.splunk.com/t5/Splunk-Search/SPL/m-p/530201#M149803 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/70277">@uagraw01</a>,</P><P>the first eval has a space before parenthesis.</P><P>Anyway, if you continue to haven't results, debug your search deleting one by one the rows from the end finding the one with problems.</P><P>In addition:</P><UL><LI>"| fields *" isn't necessary;</LI><LI>how can you have mvindex in the field host?</LI><LI>what's the meaning of "| stats values(*) AS *" ?</LI></UL><P>Ciao.</P><P>Giuseppe</P> Fri, 20 Nov 2020 12:13:57 GMT https://community.splunk.com/t5/Splunk-Search/SPL/m-p/530201#M149803 gcusello 2020-11-20T12:13:57Z