I need help on Splunk query

[thiruyadav17]

I need help on the query:

[manjunathmeti · Accepted solution]

hi @thiruyadav17 ,
1. Use stats command with eval function.

| stats count(eval(EndUserUID="EMER001")) as count

2. Does your lookup contain EndUserUID? Lookup and index should have a common field to join both.

| lookup lookup_name EndUserUID OUTPUT Subsystem Platform

You can combine 1 and 2 as below:

index=index sourcetype=sourcetype | lookup lookup_name EndUserUID OUTPUT Subsystem Platform | stats count(eval(EndUserUID="EMER001")) as count

If this reply helps you, an upvote/like would be appreciated.