topic Re: Stats showing count of 1 result vs NOT that result in Splunk Search

Stats showing count of 1 result vs NOT that result

KindaWorking — Thu, 15 Jan 2015 22:01:29 GMT

I am super new to using the powerful eval command but cannot quite get my head around the syntax. Can someone help me?

I am trying to show stats to show how many useragents have the word bot somewhere in the field vs those that do not.

... | eval type=BOT if(useragent="*bot*")|eval type=NOT if(useragent!="*bot*")|stats count by type

Re: Stats showing count of 1 result vs NOT that result

somesoni2 — Thu, 15 Jan 2015 22:15:09 GMT

Try like this

your base search | eval type=if(like(useragent,"%bot%"),"BOT","NOT") | stats count by type

Re: Stats showing count of 1 result vs NOT that result

_d_ — Thu, 15 Jan 2015 22:16:16 GMT

Try:

    ... | eval type=if(match(useragent, ".*bot.*"), "BOT", "NOT")|stats count by type

Re: Stats showing count of 1 result vs NOT that result

KindaWorking — Thu, 15 Jan 2015 22:41:50 GMT

Thanks both d and somesoni2, you were both correct. Thanks!
(I cannot add comments to your answers)

Re: Stats showing count of 1 result vs NOT that result

ppablo — Fri, 16 Jan 2015 01:09:29 GMT

Hi @KindaWorking

Glad you got two awesome answers! Question though for you. What happened exactly when you tried to comment on their answers? Did you receive an error or did a message pop up saying something about not having enough karma or permissions? This might be a bug we thought was fixed already.

Re: Stats showing count of 1 result vs NOT that result

KindaWorking — Fri, 16 Jan 2015 02:06:49 GMT

Hi ppablo, it said that I did not have enough karma.

Re: Stats showing count of 1 result vs NOT that result

ppablo — Wed, 21 Jan 2015 02:05:09 GMT

Thanks for confirming. It should be fixed now, but if you're still unable to comment on other users' answers/comments, just let me know.