topic Re: stats count(eval) always returns zero in Splunk Search

stats count(eval) always returns zero

richgalloway — Fri, 02 Jun 2017 14:05:36 GMT

I'm having problems with what should be a very simple query. I'm trying to get a count of events in an "unavailable" state based on ping time values.

... | eval Available=if(RTT>20,0,1) | stats count(eval Available==0) as "Unavailable"

I have multiple events with RTT values larger than 20 and all of those events have Available set to zero, stats always returns 0.

I've tried a few variations on count(eval), including Available=0 and if(Available=0,1,0), all with the same result.

Does anyone see what I've done wrong?

Re: stats count(eval) always returns zero

cmerriman — Fri, 02 Jun 2017 14:08:13 GMT

| eval Available=if(RTT>20,0,1) | stats count(eval(Available==0)) as "Unavailable"

you need a parenthesis between the eval and Available.

Re: stats count(eval) always returns zero

newbie2tech — Fri, 02 Jun 2017 14:10:10 GMT

can you try
... | eval Available=if(RTT>20,0,1) | where Available=0 |stats count as "Unavailable"

Re: stats count(eval) always returns zero

woodcock — Fri, 02 Jun 2017 14:24:03 GMT

Like this:

... | eval Available=if(RTT>20,0,1) | stats count(eval(Available==0)) AS Unavailable

Or better yet, this:

... | stats count(eval(RTT<=20)) AS Unavailable

Re: stats count(eval) always returns zero

richgalloway — Fri, 02 Jun 2017 14:27:05 GMT

Winner!

FTR, I originally tried count(eval (Available==0)) which also failed. Removing the space after eval fixed it.

Re: stats count(eval) always returns zero

cmerriman — Fri, 02 Jun 2017 14:32:27 GMT

also, FTR, if you need to wildcard a value ever (clearly not for this search as you only have 0 and 1), it would be count(eval(like(Available,"%0%"))) as "Unavailable"