If-statement does not work

[HeinzWaescher]

Hi,

my search looks like this:

...
| eval month=strftime(_time, "%Y_%m")
| chart dc(user_id) as count by user_id, month
| stats dc(eval(if(2013_11="1" AND 2013_12="1", user_id, null()))) AS output

The stats command does not work and I don't know why

"Error in 'stats' command: The eval expression for dynamic field 'eval(if(2013_11="1", account_id, null()))' is invalid. Error='The expression is malformed. Expected ).' "

I've used such a command many times before and Splunk never complained about it.

BR

Heinz

[martin_mueller · Accepted solution]

Non-standard field names have to be enclosed in single quotes for where and eval:

... | stats dc(eval(if('2013_11'="1" AND '2013_12'="1", user_id, null()))) AS output

[HeinzWaescher]

thank you very much!

[HeinzWaescher]

I just tried out another apporach and it seems to work fine:

...
| eval month=strftime(_time, "%Y_%m")
| stats values(month) AS months by user_id
| stats dc(eval(if(months="2013_11" AND months="2013_12", user_id, null()))) AS users

[HeinzWaescher]

In the end, I want to have a chart that shows the number of active users in 2013_12, who have been active in 2013_11 as well.

I'm wondering, why it is not possible to use it in the if command? Using it as " | search 2013_01="1" is working, so Splunk seems to know that it is the fieldname here

[HeinzWaescher]

These are the column names after the chart command. The Stats command should count number the users if the value in both columns is "1"

[strive]

Why are you using 2013_11 and 2013_12 in if condition. Could you please tell us what are you trying there?
You need to use month in if, not its value. If you give us more details we can help you to write the search