topic How to create a search for stats count eval? in Splunk Search

How to create a search for stats count eval?

jip31 — Wed, 23 Mar 2022 04:55:05 GMT

I need to use eval count in a search like this

| chart count(eval(web > 12))

But this count is right if I filter events préviously from a string

what I would like to do is something like this

| chart count(eval(web > 12 AND TOTO=a))

NB: I know I can filter before the chart command but its impossible here because my chart command stats a lot of different events...

How to do this please?

Rgds

Re: Need help with this stats count eval

ITWhisperer — Fri, 18 Mar 2022 15:25:05 GMT

| eval counter=if(web > 12 AND TOTO=a, 1, 0) | chart sum(counter)

Re: Need help with this stats count eval

somesoni2 — Fri, 18 Mar 2022 15:29:15 GMT

| chart count(eval(web > 12 AND TOTO=a))

Something like this should work. Did you try it? Is "a" a field OR a string? If it's a string, try enclosing it in double quotes.

Re: Need help with this stats count eval

jip31 — Fri, 18 Mar 2022 16:45:40 GMT

I dont undesrtand

even if I change the web_dom value, the result is the same!

| eval errcap =if(web >= 1 AND web_dom="aa" AND web_url="*", 1, 0) | eval errcont =if(we >= 1 AND web_dom="bb", 1, 0) | eval errshare =if(web= 1 AND web_dom="cc", 1, 0) | chart count(errcap) as "errcap", count(errcont) as "errcont", count(errshare) as "errshare" over Time

Re: Need help with this stats count eval

jip31 — Tue, 22 Mar 2022 15:31:59 GMT

I have something very strange

if i add a clause like web_error_code and I assign it a value (404) in the example it works

| eval errshare =if(web_error_count >= 1 AND web_error_code=404 AND web_domain="sharepoint.com", 1, 0) | stats sum(errshare)

what is put "*" instead 404, I have no results!

what is wrong please?

| eval errshare =if(web_error_count >= 1 AND web_error_code="*" AND web_domain="sharepoint.com", 1, 0) | stats sum(errshare)

Re: Need help with this stats count eval

jip31 — Tue, 22 Mar 2022 16:23:22 GMT

I found, it's Wild card for eval and where is not "*" (it only works with search command)