https://community.splunk.com/t5/Splunk-Search/Simple-eval-stats-count-by-2-fields-not-working/m-p/89076#M22821 <P>OMG. I got it to work by changing '=' to '==' and putting the value in quotes! HOW FICKLE!!</P> <PRE><CODE>sourcetype=a OR sourcetype=b | stats count as Total count(eval(sourcetype=="a")) AS a_count count(eval(sourcetype=="b")) AS b_count </CODE></PRE> Sat, 13 Oct 2012 00:33:46 GMT the_wolverine 2012-10-13T00:33:46Z https://community.splunk.com/t5/Splunk-Search/Simple-eval-stats-count-by-2-fields-not-working/m-p/89075#M22820 <P>What am I doing wrong? I've tried several iterations of the following all which return 2 columns with a count of 0:</P> <PRE><CODE>sourcetype=a OR sourcetype=b | stats count count(eval(sourcetype=a)) AS a_count count(eval(sourcetype=b)) AS b_count </CODE></PRE> <UL> <LI>"sourcetype=a OR sourcetype=b | stats count by sourcetype" &lt;= returns the correct counts but I'm unable to split the count out for further evaluation. I need to be able to eval diff=(b_count-a_count).</LI> </UL> Mon, 28 Sep 2020 12:37:23 GMT https://community.splunk.com/t5/Splunk-Search/Simple-eval-stats-count-by-2-fields-not-working/m-p/89075#M22820 the_wolverine 2020-09-28T12:37:23Z https://community.splunk.com/t5/Splunk-Search/Simple-eval-stats-count-by-2-fields-not-working/m-p/89076#M22821 <P>OMG. I got it to work by changing '=' to '==' and putting the value in quotes! HOW FICKLE!!</P> <PRE><CODE>sourcetype=a OR sourcetype=b | stats count as Total count(eval(sourcetype=="a")) AS a_count count(eval(sourcetype=="b")) AS b_count </CODE></PRE> Sat, 13 Oct 2012 00:33:46 GMT https://community.splunk.com/t5/Splunk-Search/Simple-eval-stats-count-by-2-fields-not-working/m-p/89076#M22821 the_wolverine 2012-10-13T00:33:46Z https://community.splunk.com/t5/Splunk-Search/Simple-eval-stats-count-by-2-fields-not-working/m-p/89077#M22822 <P>So glad I found this <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 04 Feb 2013 21:34:34 GMT https://community.splunk.com/t5/Splunk-Search/Simple-eval-stats-count-by-2-fields-not-working/m-p/89077#M22822 cmak 2013-02-04T21:34:34Z https://community.splunk.com/t5/Splunk-Search/Simple-eval-stats-count-by-2-fields-not-working/m-p/89078#M22823 <P>Exact same situation and exact same reaction. OMG. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 16 Sep 2014 04:14:43 GMT https://community.splunk.com/t5/Splunk-Search/Simple-eval-stats-count-by-2-fields-not-working/m-p/89078#M22823 shikhanshu 2014-09-16T04:14:43Z https://community.splunk.com/t5/Splunk-Search/Simple-eval-stats-count-by-2-fields-not-working/m-p/89079#M22824 <P>I was looking for this for days! Thanks the_wolverine</P> Thu, 04 Aug 2016 10:06:27 GMT https://community.splunk.com/t5/Splunk-Search/Simple-eval-stats-count-by-2-fields-not-working/m-p/89079#M22824 AFAS 2016-08-04T10:06:27Z