Splunk Search

Base Query return 440 events, but stats result is 0

Path Finder

Hi team,
I have below query. The base query has 440 events returned, But when I use stats command, tje number is 0. Does the because the special charaters in the string to be matched? How should I correct the string?

(servername=pc* OR host=pc*) AND
sourcetype=access_log_bizx AND
"GET /jsup?m=calibrationOrgDataV12*"
| stats count(eval(searchmatch("GET /jsup?m=calibrationOrgDataV12*"))) as number by SFDC

Tags (1)
0 Karma

 | stats count(eval(searchmatch("*calibrationOrgDataV12*"))) as number by SFDC

Searchmatch had you searching for
"GET /jsup?m=calibrationOrgDataV12*" and "/jsup?m" is not a field name in your data.

0 Karma

Path Finder

probably not as it works for me with other query before

0 Karma

Path Finder

@cheriemilk ,
by-clause will make this resolve.

check out field by SFDC , this makes results vary as you have added "by SFDC" . Thats the reason event count does not match stats count.

Try removing the "by SFDC " from your search query , it fetch the results.


Syntax: BY
Description: The name of one or more fields to group by. You cannot use a wildcard character to specify multiple fields with similar names. You must specify each field separately. The BY clause returns one row for each distinct value in the BY clause fields. If no BY clause is specified, the stats command returns only one row, which is the aggregation over the entire incoming result set.

hope this is useful.

0 Karma

Path Finder

@rkyadav ,

I removed 'by SFDC', and it returned 1 row with result is 0 as well.

I tried to escape the '=' in the query by '\m', and it returned result to me.

stats count(eval(searchmatch("GET /jsup?m\=calibrationOrgDataV12*"))) as number by SFDC


0 Karma

Ultra Champion

searchmatch use REGEX.

strings GET /jsup?m\=calibrationOrgDataV12* is match GET /jsum=calibrationOrgDataV1
not ?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...