topic Re: How to use tags in stats/eval expression? in Splunk Search

How to use tags in stats/eval expression?

hse8fe — Tue, 29 Sep 2020 18:49:00 GMT

Hello Community,

I have defined some tags like:
Field=Value --> TAG
OBJECT_TYPE=*_EMS --> EMS

Now I want to use this Tags within my eval statement:

|stats 
count(eval('tag::OBJECT_TYPE'="EMS")) AS EMS

But the count result is 0.
Thanks in advance for your support!

Re: How to use tags in stats/eval expression?

gcusello — Thu, 29 Mar 2018 12:02:32 GMT

Hi hse8fe,
at first you could change your search:

my_search tag="EMS"
| stats count

Otherwise you could use eval in a different way:

my_search
| stats count(eval(tag="EMS")) AS EMS

Bye.
Giuseppe

Re: How to use tags in stats/eval expression?

cmerriman — Thu, 29 Mar 2018 12:06:51 GMT

so maybe mine are just set up differently than yours. but my tag comes back as tag::eventtype. if yours comes back as tag::OBJECT_TYPE, perfect, keep using that.

how i got it to work:
|stats count(eval(match('tag::eventtype',"EMS"))) as EMS
but should still work with
|stats count(eval('tag::eventtype'="EMS")) as EMS
or just
|stats count(eval(tag="EMS")) as EMS

Re: How to use tags in stats/eval expression?

hse8fe — Thu, 29 Mar 2018 12:36:42 GMT

Hello both,

Unfortunately all of your provided suggestions are returning 0 (which is not true):

  count(eval(tag="WWV")) AS WWV 
  count(eval(tag='WWV')) AS WWV0 
  count(eval('tag::OBJECT_TYPE'="WWV")) AS WWV1
  count(eval(match('tag::OBJECT_TYPE',"WWV"))) AS WWV2

Do you have any other ideas?!?

It's working with an AND combined search like

count(eval(like(OBJECT_TYPE,"WWV%")OR like(OBJECT_TYPE,"%WWV"))) AS WWV

But it would be much more elegant for me to define the groupings globally with tags .

Thanks and regards Sebastian

Re: How to use tags in stats/eval expression?

gcusello — Thu, 29 Mar 2018 13:39:57 GMT

My first solution, that uses tags, could work for you?
Bye.
Giuseppe

Re: How to use tags in stats/eval expression?

hse8fe — Thu, 29 Mar 2018 13:50:48 GMT

I need to evaluate different tags in the result, here is my actual code without an search, the tags are defined centrally in the tag definition for the field OBJECT_TYPE.

index="eai_tsim_account_p" host="rbedilif" | stats  
count(eval(tag="WWV")) AS WWV0  
count(eval('tag::OBJECT_TYPE'="WWV")) AS WWV1 
count(eval(match('tag::OBJECT_TYPE',"WWV"))) AS WWV2 
count(eval(like(OBJECT_TYPE,"WWV%"))) AS WWV
count(eval(like(OBJECT_TYPE,"IFT%") OR like(OBJECT_TYPE,"IFC%") OR like(OBJECT_TYPE,"XML_INVOIC%") OR like(OBJECT_TYPE,"UTILMD%") OR like(OBJECT_TYPE,"XML_EPCIS"))) AS TMS  
count(eval(like(OBJECT_TYPE,"%VMI"))) AS VMI count(eval(like(OBJECT_TYPE,"INVRPTE%")OR like(OBJECT_TYPE,"DELJIT_SUPO_EMS") OR like(OBJECT_TYPE,"APERAK"))) AS EMS 
count(eval(like(OBJECT_TYPE,"DELFOR") OR like(OBJECT_TYPE,"DESADV") OR like(OBJECT_TYPE,"vda%") OR like(OBJECT_TYPE,"X12%") OR like(OBJECT_TYPE,"ORD%") OR like(OBJECT_TYPE,"INVRPT") OR like(OBJECT_TYPE,"edl") OR like(OBJECT_TYPE,"DELJIT"))) AS Procurement   
| transpose

This search/count is working for WWV, TMS, EMS and PROCURMENT but not for the first three tag based results WWV0, WWV1, WWV2