topic Re: Unable to get count when variable names has a "-" in Splunk Search

Unable to get count when variable names has a "-"

vjzone — Fri, 17 Aug 2018 01:46:46 GMT

One of the queries i'm using has a variable with a "-" and splunk is unable to get me the stats count using the variable.

Example : your search | stats count by Order-Type

Is there a limitation on the variable names to be used in splunk?

Note: I did get the final result by using regex.
Example: your search | rex field=raw "Order-Type=(?[\"A-Z ]+)" | stats count by type

Re: Unable to get count when variable names has a "-"

richgalloway — Fri, 17 Aug 2018 11:32:56 GMT

The stats command is probably trying to subtract field 'Type' from field 'Order' and is failing because neither field exists. Try one of the following:

1) ... | stats count by 'Order-Type'

2) ... | rename "Order-Type" as OrderType | stats count by OrderType | rename OrderType as "Order-Type"

3) Use a different field name without a hyphen in it.

Re: Unable to get count when variable names has a "-"

vjzone — Fri, 17 Aug 2018 16:14:11 GMT

I have already tried #1 and #2, but that doesn't seem to work. #3 is not an option without a code change and i do not want to take that route.

Re: Unable to get count when variable names has a "-"

vjzone — Fri, 17 Aug 2018 17:02:44 GMT

Updated the example: your search | rex field=raw "Order-Type=(?[\"A-Z ]+)" | stats count by type

Re: Unable to get count when variable names has a "-"

nadlurinadluri — Fri, 17 Aug 2018 22:19:30 GMT

I did try to replicate the same scenario and for me its working fine without any issues. If you are not getting the desired results using @richgalloway`s response, try creating a new filed for Order-Type using the below command.
|eval OrderType='Order-Type'
|stats count by OrderType

Re: Unable to get count when variable names has a "-"

woodcock — Mon, 20 Aug 2018 17:56:12 GMT

Like this

... rename *-* AS ** ... | stats count by OrderType

Re: Unable to get count when variable names has a "-"

vjzone — Wed, 22 Aug 2018 01:01:00 GMT

This is weird. I can no longer do a stats count by with variables separated by -. I think i was able to do this earlier. Is there something s Splunk admin could do to disable this?

Re: Unable to get count when variable names has a "-"

vjzone — Wed, 22 Aug 2018 23:36:58 GMT

I got the answer after talking to a friend. Splunk parsed the field Order-Type as Order_Type(listed in interesting fields of verbose mode).

All i needed to do was "your search | stats count by Order_Type"

Thanks guys!

Re: Unable to get count when variable names has a "-"

nadlurinadluri — Wed, 22 Aug 2018 23:41:25 GMT

Right!! thats actually true, splunk converts '-' to '_' at the time of ingestion.