Splunk Search

Eventstats not returning expected results

smruti13
Observer

Hi Splunk Gurus! 

I have come across an absurd issue where my eventstats is not recognizing the field value. 

Sample Problem:

Field1source
(Blank)dummy_source.csv
Record1dummy2_cource.csv

 

query:

|eventstats dc(source) as check by Field1

expected o/p: 

Field1sourcecheck
(Blank)dummy_source.csv 
Record1dummy2_cource.csv1

 

current o/p:

Field1sourcecheck
(Blank)dummy_source.csv 
Record1dummy2_cource.csv 

 

Additional Info:  I have the following message in my Splunk- Failed to register with cluster master... (not sure if its got something to do with the problem )

Any help is appreciated !

Thanks :slightly_smiling_face:

Labels (2)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

This looks strange for me. I have just tried with same field Field1 and its working as expected. I was thinking there could be an issue with an integer post fixed to the field. 

you can try couple things:

filter to get Record1. search Field1="Record1"

enclose Field1 in double quotes : |eventstats dc(source) as check by "Field1"

just add | fields Field1 to see whether you are seeing this field.

can you run eventstats for other events and see if thats working.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...