How to create a search for matching two fields value to one new field?

[mohsplunking]

Hello Splunker,

I'm trying to  join two fields values in stats command using Eval , looks like I'm doing it wrong, Please help me with the correct syntax.

| stats count (eval(action="Not Found",action="Forbidden")) as failures by src
| where failures>100
| table src

Basically I'm trying call "Not Found" and "Forbidden" as Failures that happened from a single source and then make a count of both these fields. 

A Help  here is appreciated,

Thanks,

Moh

[bowesmana]

The eval statement is wrong - use sum and an if condition to evaluate to 1 or 0

| stats sum(eval(if(action="Not Found" OR action="Forbidden",1,0))) as failures by src

[dural_yyz]

It appears that the field action has text values and you are trying to apply a volume limit where statement.  You could create a new field of 'tmp' if action IN (value1 value2), "1","0").  At that point you can stats count or sum the new field and apply your where statement based upon your own needs.

Just a thought.

[yuanliu]

You are almost there.

| stats count (eval(action IN ("Not Found","Forbidden"))) as failures by src
| where failures>100 | table src

[mohsplunking]

Thanks for looking into it, however, it did not go through, it still gives an error

The argument '(eval(action IN (Not Found,Forbidden)))' is invalid 😞

[yuanliu]

---

The argument '(eval(action IN (Not Found,Forbidden)))' is invalid 😞

---

Did you use quotation marks as my example includes?

[mohsplunking]

Hello Yuanliu,

Thanks once again for your efforts,

Yes i did add the quotes , basically I copy pasted from here to search directly.  Have you tested this at your end by any chance

Thanks,

[yuanliu · Accepted solution]

Yes, the syntax was tested.  Here is test code you can try anywhere

index=_internal
| stats count(eval(sourcetype IN ("splunkd_access", "splunkd_ui_access"))) as selective_with_IN count as all by source

Result on my laptop instance is

source	selective_with_IN	all
/Applications/Splunk/var/log/splunk/health.log	0	5884
/Applications/Splunk/var/log/splunk/license_usage.log	0	2
/Applications/Splunk/var/log/splunk/metrics.log	0	45872
/Applications/Splunk/var/log/splunk/metrics.log.1	0	2
/Applications/Splunk/var/log/splunk/mongod.log	0	1
/Applications/Splunk/var/log/splunk/python.log	0	376
/Applications/Splunk/var/log/splunk/search_messages.log	0	1
/Applications/Splunk/var/log/splunk/splunkd.log	0	28780
/Applications/Splunk/var/log/splunk/splunkd_access.log	6068	6068
/Applications/Splunk/var/log/splunk/splunkd_ui_access.log	804	804
/Applications/Splunk/var/log/splunk/web_access.log	0	68
/Applications/Splunk/var/log/splunk/web_service.log	0	197

My version is 9.1.

Using the syntax @bowesmana gives result in the same

index=_internal
| stats sum(eval(if(sourcetype IN ("splunkd_access", "splunkd_ui_access"), 1, 0))) as selective_with_IN count as all by source

[mohsplunking]

Thanks so much @yuanliu @bowesmana  both for the great help,

@yuanliu  So after you post the second query with the results there I was to catch the difference from your previous query and the last one, I was not getting results because in the stats command I was giving space between "count and Eval" , if I do that , it does not get execute. :d

Anyway, it a perfect query for my use-case, Much Appreciated !