topic Re: Error after stats command in Splunk Search

Error after stats command

hoerberm — Thu, 18 Dec 2014 16:33:05 GMT

Hi,

I need your help,

I have a search like this

index=test sourcetype=XY | stats count(Field1) AS f1 by action="Value1" Field2 | stats count(Field3) AS f3 by action="Value2" Field2  | eval sum=Field1+Field2 | eval pro1=Field1/sum*100 | eval pro2=Field3/sum*100 | table Field2 f1, pro1, f3, p2, sum

After running the search there is the Error:
Error in 'stats' command: The argument 'Field100=Value1' is invalid.

Has anyone an Idea how I can change the search that the search is running?

Thanks for your help

Re: Error after stats command

aweitzman — Thu, 18 Dec 2014 16:44:38 GMT

I'm not sure what you're trying to do, but by action="SomeValue" is not a valid by clause in stats. You can only list fields there.

http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Stats

What are you trying to do?

Re: Error after stats command

Ayn — Fri, 19 Dec 2014 05:38:15 GMT

Also your multiple stats commands will not work, because the first stats command consumes all data that goes into it and only emits whatever fields it calculates.

Perhaps you want something like this?

index=test sourcetype=XY action="Value1" OR action="Value2" | stats count(eval(action=="Value1")) as Field1, count(eval(action=="Value2")) as Field2 | ...

Re: Error after stats command

fdi01 — Mon, 28 Sep 2020 18:24:17 GMT

Re: Error after stats command

pragycho — Tue, 29 Sep 2020 21:28:59 GMT

hi ,
I need your help to set filter between min and max range.
i have created two dropdown box.

  <label>Min  value</label>
  <choice value="-5">-5</choice>
  <choice value="-4">-4</choice>
  <choice value="-3">-3</choice>
  <choice value="-2">-2</choice>
  <choice value="-1">-1</choice>
  <choice value="0">0</choice>
  <choice value="1">1</choice>
  <choice value="2">2</choice>
  <choice value="3">3</choice>
  <choice value="4">4</choice>
  <choice value="5">5</choice>

  <default>-10</default>
</input>


  <label>Max value</label>

  <choice value="-5">-5</choice>
  <choice value="-4">-4</choice>
  <choice value="-3">-3</choice>
  <choice value="-2">-2</choice>
  <choice value="-1">-1</choice>
  <choice value="0">0</choice>
  <choice value="1">1</choice>
  <choice value="2">2</choice>
  <choice value="3">3</choice>
  <choice value="4">4</choice>
  <choice value="5">5</choice>    
</input>

then create two filter
FILTER score > "$min_score$"
FILTER score < "$max_score$"
---------------------> here i am facing issue in xml parsing for operator less than (<)
this is error :
XML Syntax Error: StartTag: invalid element name,