https://community.splunk.com/t5/Splunk-Search/Regex-inside-eval-is-not-working/m-p/556881#M158167 <P>I am trying to do a stats count where 2XX https response means as success and any non 2XX means that it's a failure. I am using below snippet. But it doesn't work. Am I missing something ?</P><P>&nbsp;</P><P>stats&nbsp; count(eval(httpresponse="2*")) as TRANSACTIONS_SUCCESS,&nbsp; count(eval(httpresponse!="2*"))&nbsp;as TRANSACTIONS_FAILURE by service</P> Wed, 23 Jun 2021 15:41:16 GMT pjtbasu 2021-06-23T15:41:16Z https://community.splunk.com/t5/Splunk-Search/Regex-inside-eval-is-not-working/m-p/556881#M158167 <P>I am trying to do a stats count where 2XX https response means as success and any non 2XX means that it's a failure. I am using below snippet. But it doesn't work. Am I missing something ?</P><P>&nbsp;</P><P>stats&nbsp; count(eval(httpresponse="2*")) as TRANSACTIONS_SUCCESS,&nbsp; count(eval(httpresponse!="2*"))&nbsp;as TRANSACTIONS_FAILURE by service</P> Wed, 23 Jun 2021 15:41:16 GMT https://community.splunk.com/t5/Splunk-Search/Regex-inside-eval-is-not-working/m-p/556881#M158167 pjtbasu 2021-06-23T15:41:16Z https://community.splunk.com/t5/Splunk-Search/Regex-inside-eval-is-not-working/m-p/556882#M158168 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/71017">@pjtbasu</a>&nbsp;</P><P>Can you please try this?</P><LI-CODE lang="markup">YOUR_SEARCH | stats sum(eval(if(like(httpresponse,"2%"),1,0))) as TRANSACTIONS_SUCCESS, sum(eval(if(!like(httpresponse,"2%"),1,0))) as TRANSACTIONS_FAILURE by service</LI-CODE><P>&nbsp;</P><P>Thanks<BR />KV<BR />▄︻̷̿┻̿═━一<BR /><BR />If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.&nbsp;</P> Wed, 23 Jun 2021 15:48:13 GMT https://community.splunk.com/t5/Splunk-Search/Regex-inside-eval-is-not-working/m-p/556882#M158168 kamlesh_vaghela 2021-06-23T15:48:13Z