Archive

Base Query return 440 events, but stats result is 0

cheriemilk
Path Finder

Hi team,
I have below query. The base query has 440 events returned, But when I use stats command, tje number is 0. Does the because the special charaters in the string to be matched? How should I correct the string?

(servername=pc* OR host=pc*) AND
sourcetype=access_log_bizx AND
"GET /jsup?m=calibrationOrgDataV12*"
| stats count(eval(searchmatch("GET /jsup?m=calibrationOrgDataV12*"))) as number by SFDC

Tags (1)
0 Karma

jkat54
SplunkTrust
SplunkTrust
 | stats count(eval(searchmatch("*calibrationOrgDataV12*"))) as number by SFDC

Searchmatch had you searching for
"GET /jsup?m=calibrationOrgDataV12*" and "/jsup?m" is not a field name in your data.

0 Karma

cheriemilk
Path Finder

@jkat54
probably not as it works for me with other query before

0 Karma

rkyadav
Path Finder

@cheriemilk ,
by-clause will make this resolve.

check out field by SFDC , this makes results vary as you have added "by SFDC" . Thats the reason event count does not match stats count.

Try removing the "by SFDC " from your search query , it fetch the results.

https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Stats

by-clause
Syntax: BY
Description: The name of one or more fields to group by. You cannot use a wildcard character to specify multiple fields with similar names. You must specify each field separately. The BY clause returns one row for each distinct value in the BY clause fields. If no BY clause is specified, the stats command returns only one row, which is the aggregation over the entire incoming result set.

hope this is useful.

0 Karma

cheriemilk
Path Finder

@rkyadav ,

I removed 'by SFDC', and it returned 1 row with result is 0 as well.

I tried to escape the '=' in the query by '\m', and it returned result to me.

stats count(eval(searchmatch("GET /jsup?m\=calibrationOrgDataV12*"))) as number by SFDC

Why?

0 Karma

to4kawa
SplunkTrust
SplunkTrust

searchmatch use REGEX.

strings GET /jsup?m\=calibrationOrgDataV12* is match GET /jsum=calibrationOrgDataV1
not ?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!