https://community.splunk.com/t5/Splunk-Search/How-to-use-Stats-and-Eval-to-count-how-many-times-quot-Microsoft/m-p/184033#M52999 <P>How could I search these stat fields? I am trying to search these fields in a drill down. The user can pick all or the name of the OS. I can't figure out how to. I am trying to do it something like this. </P> <P>| search values(OS_Detected)=="$OS_Detected$"</P> <P>If i just search OS_Detected=$OS_Detected$ I will not return the other events with other info. I am trying really hard to not use a join.</P> Mon, 28 Sep 2020 17:23:44 GMT mgubser 2020-09-28T17:23:44Z https://community.splunk.com/t5/Splunk-Search/How-to-use-Stats-and-Eval-to-count-how-many-times-quot-Microsoft/m-p/184031#M52997 <P>I am reading nessus discovery scan logs and the way nessus formats their data is by separating fields by events. They run one test on an IP and get one result so for one IP they could have 30 events one having the Host Name, OS, Device type, etc.. When I use</P> <PRE><CODE>Stats values(Computer_Name) values(Device_Type) values(Domain_Name) values(Device_FQDN) values(Device_HostName) values(MAC_Address) values(OS_Detected) values(Computer_Name) by Host </CODE></PRE> <P>I get all the fields I wanna see by Host(IP). I am unaware on how to search a specific stat to include a phrase as apposed to match it. If I do </P> <PRE><CODE>|stats count(eval(OS_Detected=="Microsoft*")) AS Microsoft </CODE></PRE> <P>I get a new field Microsoft that is all 0's</P> <PRE><CODE>|stats count(eval(OS_Detected=="Microsoft Windows 7 Enterprise")) AS Microsoft </CODE></PRE> <P>I get a 1 in that field for the ones that match</P> <P>Thanks, Matt</P> Fri, 15 Aug 2014 20:34:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-Stats-and-Eval-to-count-how-many-times-quot-Microsoft/m-p/184031#M52997 mgubser 2014-08-15T20:34:15Z https://community.splunk.com/t5/Splunk-Search/How-to-use-Stats-and-Eval-to-count-how-many-times-quot-Microsoft/m-p/184032#M52998 <P>Use it like this (your current stats 'count(eval(OS_Detected=="Microsoft*"))' doesn't treat "*" as wildcard but a regular character, hence 0 count)</P> <PRE><CODE>|stats count(eval(like(OS_Detected,"Microsoft%")) AS Microsoft </CODE></PRE> Fri, 15 Aug 2014 20:42:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-Stats-and-Eval-to-count-how-many-times-quot-Microsoft/m-p/184032#M52998 somesoni2 2014-08-15T20:42:05Z https://community.splunk.com/t5/Splunk-Search/How-to-use-Stats-and-Eval-to-count-how-many-times-quot-Microsoft/m-p/184033#M52999 <P>How could I search these stat fields? I am trying to search these fields in a drill down. The user can pick all or the name of the OS. I can't figure out how to. I am trying to do it something like this. </P> <P>| search values(OS_Detected)=="$OS_Detected$"</P> <P>If i just search OS_Detected=$OS_Detected$ I will not return the other events with other info. I am trying really hard to not use a join.</P> Mon, 28 Sep 2020 17:23:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-Stats-and-Eval-to-count-how-many-times-quot-Microsoft/m-p/184033#M52999 mgubser 2020-09-28T17:23:44Z