How to edit my search to get the counts and eval results for each value of a certain field?

[Catie_Carmody]

The below returns the correct results, but I only get the RequestOne, RequestTwo, and meetscriteria fields when field1= test:

sourcetype=application_log field1= test | stats count(eval(match(_raw, "Request 1"))) AS "RequestOne", count(eval(match(_raw, "Request 2"))) AS "RequestTwo" | eval meetscriteria = if(('Request1' >= 100 AND 'Request2' > 0), "OK", "No")

I have many fields for field1 though and want to capture the counts and "meetscriteria" information for each value of field1. How can I capture this information?

I have also saved these using eventtypes and tags, but you can't group on these? Do I need to use a lookup table or a join?

[Catie_Carmody · Accepted solution]

I resolved it by adding a "by field1" in the second pipe and removing the field1 criteria from the initial search:

sourcetype=application_log | stats count(eval(match(_raw, "Request 1"))) AS "RequestOne", count(eval(match(_raw, "Request 2"))) AS "RequestTwo" by field1| eval meetscriteria = if(('Request1' >= 100 AND 'Request2' > 0), "OK", "No")

I had originally created eventtypes for both "Request 1" and "Request 2", but this seemed limited such that I couldn't run eval against eventtypes or do groupings.

[sundareshr]

Change field1=test to field1=* or remove the field1= criteria altogether.