I created a calculated field called "SUCCESS" using Splunk Web on sourcetype. The calculated field eval condition is like if(TYPE="S", "Success", null). Now I am trying to use this calculated field in my search like below -
index=customindex sourcetype=customsource | stats count(SUCCESS) as SuccessCount
But this returns no results and I know there are events in source that qualifies eval conditions. Not sure what I am doing wrong?