I am using DBConnect to connect to a DB export from Qualys
This export shows the results of a scan to determine if autoplay is disabled
I want to create a % machines that are compliant - the table has
ID | HOSTID | CONTROLID | STATUS
when using the below search it shows me 0 results in passed and the total machine number is 575 (passed & failed)
| dbquery "DB_NAME" "SELECT * FROM SANS0503" | stats count(eval(STATUS=Passed)) as Passed count as total
If I perform | dbquery "DB_NAME" "SELECT * FROM SANS0503" | search STATUS=Passed I get the result of 551 (which is great) but I do not understand why I am getting 0?
Have you tried
...| stats count(eval(STATUS="Passed")) ...?
that worked perfectly - thank you so much!
Sorry to be annoying but why does it require ""
a very similar search
stats count(eval(FAILED<1)) as success count as total | eval Compliant %=success/total*100
Works perfectly without?
eval(STATUS=Passed) Splunk is comparing the field STATUS to the field Passed.
eval(STATUS="Passed") Splunk is comparing the field STATUS to the string "Passed".
eval(FAILED<1) Splunk is comparing the field FAILED to the number 1.
Yes, it's a little inconsistent with the
search command that accepts strings without quotes.
Thanks again Rich
It's just I am trying work out where I am going wrong, to avoid posting to many community questions 🙂