https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-not-showing-the-count-in-the-resulting-table/m-p/271486#M81731 <P>Hi,</P> <P>I have this query</P> <PRE><CODE>index=cox UCE-|rex "UCE-(?&lt;UCE_Code&gt;(\d+))"|lookup UCECodes.csv UCE-Code as UCE_Code|eval ud=UCE_Code+" - "+Desc|eventstats count as grandtotal |eventstats count as ptotal by UCE_Code|eval aatype=if(match(source,"managedServer"),"managed","access")|chart values(Desc) as Description count(UCE_Code) as "UCE Code Count" count(aatype="managed") as "Managed Server Log" count(aatype="access") as "Access Log" values(eval(round(ptotal/grandtotal*100,2))) as Percentage by UCE_Code |rename UCE_Code as "UCE Code - Click for Detail"|sort - "Percentage"|rename ud as "UCE Code - Description" </CODE></PRE> <P>And I'm interested in the <STRONG>aatype</STRONG> field. When the query runs, the resulting table has everything correct, EXCEPT the columns "Managed Server Log" and "Access Log" are all zeros. However, when I view the event fields, the <STRONG>aatype</STRONG> field shows the correct values.</P> <P>What am I missing?</P> <P>Here is the statistics table and event field<span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2222iDC33C069BC3BFD9E/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 12 Dec 2016 20:03:37 GMT dbcase 2016-12-12T20:03:37Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-not-showing-the-count-in-the-resulting-table/m-p/271486#M81731 <P>Hi,</P> <P>I have this query</P> <PRE><CODE>index=cox UCE-|rex "UCE-(?&lt;UCE_Code&gt;(\d+))"|lookup UCECodes.csv UCE-Code as UCE_Code|eval ud=UCE_Code+" - "+Desc|eventstats count as grandtotal |eventstats count as ptotal by UCE_Code|eval aatype=if(match(source,"managedServer"),"managed","access")|chart values(Desc) as Description count(UCE_Code) as "UCE Code Count" count(aatype="managed") as "Managed Server Log" count(aatype="access") as "Access Log" values(eval(round(ptotal/grandtotal*100,2))) as Percentage by UCE_Code |rename UCE_Code as "UCE Code - Click for Detail"|sort - "Percentage"|rename ud as "UCE Code - Description" </CODE></PRE> <P>And I'm interested in the <STRONG>aatype</STRONG> field. When the query runs, the resulting table has everything correct, EXCEPT the columns "Managed Server Log" and "Access Log" are all zeros. However, when I view the event fields, the <STRONG>aatype</STRONG> field shows the correct values.</P> <P>What am I missing?</P> <P>Here is the statistics table and event field<span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2222iDC33C069BC3BFD9E/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 12 Dec 2016 20:03:37 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-not-showing-the-count-in-the-resulting-table/m-p/271486#M81731 dbcase 2016-12-12T20:03:37Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-not-showing-the-count-in-the-resulting-table/m-p/271487#M81732 <P>Hi there @dbcase</P> <P>Try like this,</P> <PRE><CODE>index=cox UCE- | rex "UCE-(?&lt;UCE_Code&gt;(\d+))" | lookup UCECodes.csv UCE-Code AS UCE_Code | eval ud=UCE_Code+" - "+Desc | eventstats count AS grandtotal | eventstats count AS ptotal by UCE_Code | eval aatype=if(match(source,"managedServer"), "managed", "access") | chart values(Desc) AS Description, count(UCE_Code) AS "UCE Code Count", count(eval(aatype="managed")) AS "Managed Server Log", count(eval(aatype="access")) AS "Access Log", values(eval(round(ptotal/grandtotal*100,2))) AS Percentage by UCE_Code | rename UCE_Code AS "UCE Code - Click for Detail" | sort - "Percentage" | rename ud AS "UCE Code - Description" </CODE></PRE> <P>Let me know if it works.</P> Mon, 12 Dec 2016 20:32:33 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-not-showing-the-count-in-the-resulting-table/m-p/271487#M81732 alemarzu 2016-12-12T20:32:33Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-not-showing-the-count-in-the-resulting-table/m-p/271488#M81733 <P>Hey alemarzu! That worked perfectly!!! Many thanks!</P> Mon, 12 Dec 2016 21:15:20 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-not-showing-the-count-in-the-resulting-table/m-p/271488#M81733 dbcase 2016-12-12T21:15:20Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-not-showing-the-count-in-the-resulting-table/m-p/271489#M81734 <P>Nice, I'm glad it helped!</P> Tue, 13 Dec 2016 12:22:10 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-not-showing-the-count-in-the-resulting-table/m-p/271489#M81734 alemarzu 2016-12-13T12:22:10Z