topic Re: Base Query return 440 events, but stats result is 0 in Splunk Search

Base Query return 440 events, but stats result is 0

cheriemilk — Wed, 30 Sep 2020 05:19:30 GMT

Hi team,
I have below query. The base query has 440 events returned, But when I use stats command, tje number is 0. Does the because the special charaters in the string to be matched? How should I correct the string?

(servername=pc* OR host=pc*) AND
sourcetype=access_log_bizx AND
"GET /jsup?m=calibrationOrgDataV12*"
| stats count(eval(searchmatch("GET /jsup?m=calibrationOrgDataV12*"))) as number by SFDC

Re: Base Query return 440 events, but stats result is 0

rkyadav — Thu, 07 May 2020 09:36:33 GMT

@cheriemilk ,
by-clause will make this resolve.

check out field by SFDC , this makes results vary as you have added "by SFDC" . Thats the reason event count does not match stats count.

Try removing the "by SFDC " from your search query , it fetch the results.

https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Stats

by-clause
Syntax: BY
Description: The name of one or more fields to group by. You cannot use a wildcard character to specify multiple fields with similar names. You must specify each field separately. The BY clause returns one row for each distinct value in the BY clause fields. If no BY clause is specified, the stats command returns only one row, which is the aggregation over the entire incoming result set.

hope this is useful.

Re: Base Query return 440 events, but stats result is 0

jkat54 — Thu, 07 May 2020 10:03:18 GMT

 | stats count(eval(searchmatch("*calibrationOrgDataV12*"))) as number by SFDC

Searchmatch had you searching for
"GET /jsup?m=calibrationOrgDataV12*" and "/jsup?m" is not a field name in your data.

Re: Base Query return 440 events, but stats result is 0

cheriemilk — Tue, 12 May 2020 02:41:07 GMT

@rkyadav ,

I removed 'by SFDC', and it returned 1 row with result is 0 as well.

I tried to escape the '=' in the query by '\m', and it returned result to me.

stats count(eval(searchmatch("GET /jsup?m\=calibrationOrgDataV12*"))) as number by SFDC

Why?

Re: Base Query return 440 events, but stats result is 0

cheriemilk — Tue, 12 May 2020 02:42:23 GMT

@jkat54
probably not as it works for me with other query before

Re: Base Query return 440 events, but stats result is 0

to4kawa — Tue, 12 May 2020 03:09:16 GMT

searchmatch use REGEX.

strings GET /jsup?m\=calibrationOrgDataV12* is match GET /jsum=calibrationOrgDataV1
not ?