I have below query. The base query has 440 events returned, But when I use stats command, tje number is 0. Does the because the special charaters in the string to be matched? How should I correct the string?
(servername=pc* OR host=pc*) AND
| stats count(eval(searchmatch("GET /jsup?m=calibrationOrgDataV12*"))) as number by SFDC
| stats count(eval(searchmatch("*calibrationOrgDataV12*"))) as number by SFDC
Searchmatch had you searching for
"GET /jsup?m=calibrationOrgDataV12*" and "/jsup?m" is not a field name in your data.
by-clause will make this resolve.
check out field by SFDC , this makes results vary as you have added "by SFDC" . Thats the reason event count does not match stats count.
Try removing the "by SFDC " from your search query , it fetch the results.
Description: The name of one or more fields to group by. You cannot use a wildcard character to specify multiple fields with similar names. You must specify each field separately. The BY clause returns one row for each distinct value in the BY clause fields. If no BY clause is specified, the stats command returns only one row, which is the aggregation over the entire incoming result set.
hope this is useful.
I removed 'by SFDC', and it returned 1 row with result is 0 as well.
I tried to escape the '=' in the query by '\m', and it returned result to me.
stats count(eval(searchmatch("GET /jsup?m\=calibrationOrgDataV12*"))) as number by SFDC