Eventstats not returning expected results

[smruti13]

Hi Splunk Gurus! 

I have come across an absurd issue where my eventstats is not recognizing the field value. 

Sample Problem:

Field1	source
(Blank)	dummy_source.csv
Record1	dummy2_cource.csv

query:

|eventstats dc(source) as check by Field1

expected o/p: 

Field1	source	check
(Blank)	dummy_source.csv
Record1	dummy2_cource.csv	1

current o/p:

Field1	source	check
(Blank)	dummy_source.csv
Record1	dummy2_cource.csv

Additional Info:  I have the following message in my Splunk- Failed to register with cluster master... (not sure if its got something to do with the problem )

Any help is appreciated !

Thanks 🙂

[thambisetty]

This looks strange for me. I have just tried with same field Field1 and its working as expected. I was thinking there could be an issue with an integer post fixed to the field. 

you can try couple things:

filter to get Record1. search Field1="Record1"

enclose Field1 in double quotes : |eventstats dc(source) as check by "Field1"

just add | fields Field1 to see whether you are seeing this field.

can you run eventstats for other events and see if thats working.