Base Query return 440 events, but stats result is 0

[cheriemilk]

Hi team,
I have below query. The base query has 440 events returned, But when I use stats command, tje number is 0. Does the because the special charaters in the string to be matched? How should I correct the string?

(servername=pc* OR host=pc*) AND
sourcetype=access_log_bizx AND
"GET /jsup?m=calibrationOrgDataV12*"
| stats count(eval(searchmatch("GET /jsup?m=calibrationOrgDataV12*"))) as number by SFDC

[jkat54]

 | stats count(eval(searchmatch("*calibrationOrgDataV12*"))) as number by SFDC

Searchmatch had you searching for
"GET /jsup?m=calibrationOrgDataV12*" and "/jsup?m" is not a field name in your data.

[cheriemilk]

@jkat54
probably not as it works for me with other query before

[rkyadav]

@cheriemilk ,
by-clause will make this resolve.

check out field by SFDC , this makes results vary as you have added "by SFDC" . Thats the reason event count does not match stats count.

Try removing the "by SFDC " from your search query , it fetch the results.

https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Stats

by-clause
Syntax: BY
Description: The name of one or more fields to group by. You cannot use a wildcard character to specify multiple fields with similar names. You must specify each field separately. The BY clause returns one row for each distinct value in the BY clause fields. If no BY clause is specified, the stats command returns only one row, which is the aggregation over the entire incoming result set.

hope this is useful.

[cheriemilk]

@rkyadav ,

I removed 'by SFDC', and it returned 1 row with result is 0 as well.

I tried to escape the '=' in the query by '\m', and it returned result to me.

stats count(eval(searchmatch("GET /jsup?m\=calibrationOrgDataV12*"))) as number by SFDC

Why?

[to4kawa]

searchmatch use REGEX.

strings GET /jsup?m\=calibrationOrgDataV12* is match GET /jsum=calibrationOrgDataV1
not ?