Splunk Search

How to use eval for basic search terms (NOT fields)?

link22
Explorer

So I want to get the stats count of two search terms in a search that looks like this:
index=myIndex "searchTermA" OR "searchTermB" (these searches being strings to find certain applications under the index and they have no fields to search for them by nor are they similar enough for field extraction to work [individually field extracting these also proves to have a lot of issues as well]).

and what I wish I could do is this:

index=myIndex "searchTermA" OR "searchTermB"  | stats (or chart/timechart) count("searchTermA") count("searchTermB")

to get the data I want.

However, I am aware this is not possible. Is there some way to use eval to give these search strings a name and use them for count?

I also cannot go into the .conf files and edit them.

Thanks!

0 Karma
1 Solution

somesoni2
Revered Legend

You can something like this

index=myIndex "searchTermA" OR "searchTermB" | stats  count(eval(searchmatch("searchTermA"))) as CountA count(eval(searchmatch("searchTermB"))) as CountB

View solution in original post

0 Karma

somesoni2
Revered Legend

You can something like this

index=myIndex "searchTermA" OR "searchTermB" | stats  count(eval(searchmatch("searchTermA"))) as CountA count(eval(searchmatch("searchTermB"))) as CountB
0 Karma

brendanmatthews
Explorer

You can run something like ... |eval count_field = case(searchmatch("searchtermA"), "A_class",searchmatch("searchtermB"),"B_class") | stats (or chart/timechart) count by count_field. It should return the counts of both types of events.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...