Help with an eval statement?

[svemurilv]

I am trying to build a base search for the field message.device.category , it has 3 values: desktop , mobile and tablet.

Using eval I am trying to divide the field with separate values.

search | eval MobileUsers=if("message.device.category" == "Mobile", "Mobile",NULL) |eval DesktopUsers=if("message.device.category" == "Desktop", "Desktop",NULL) |eval tabUsers=if("message.device.category" == "Tablet", "Tablet",NULL) |event stats count(DesktopUsers) ,count (MobileUsers) ,count(tabUsers)

its not returning any values in the counts.

[sbbadri · Accepted solution]

@svemurilv

try this,

your search here | eval result_users = case("message.device.category" == "Mobile", "Mobile","message.device.category" == "Desktop", "Desktop","message.device.category" == "Tablet", "Tablet") | stats count by result_users

[mwdbhyat]

I can see that you have written eventstats as "event stats" and a space between the count and the (Mobile...).. im guessing thats formatting on this page?

Is the search returning anything without the eventstats section?