Splunk Search

Issue with stats count(eval()) command

jvmerilla
Path Finder

Hi,

I have this query:

index="sample_data" sourcetype="analytics_sampledata.csv" 
| rename "Resolution Code" as Resolution_Code
| stats count(eval(Status!="Closed")) as "Open Tickets", count(eval(Status="Closed" AND Resolution_Code="Not Resolved *")) as "Closed/Not Resolved Tickets"

And this is the result:
alt text

I don't know what could be wrong with query but the second eval is not returning any value.

I hope anyone would shed a light on this.

Thank you.

0 Karma
1 Solution

Yunagi
Communicator

I don't think that eval supports wildcards (*).

Try

eval(Status=="Closed" AND like(Resolution_Code,"Not Resolved %"))

View solution in original post

mayurr98
Super Champion

hey @jvmerilla

Try this,
index="sample_data" sourcetype="analytics_sampledata.csv"
| rename "Resolution Code" as Resolution_Code
| stats count(eval(Status!="Closed")) as "Open Tickets", count(eval((like(Resolution_Code,"Not Resolved%")) AND Status="Closed")) as "Closed/Not Resolved Tickets"

Let me know if it helps!

jvmerilla
Path Finder

Hi @mayurr98,

It also works.
Thank you. 🙂

So the main cause of the error is the *, and also the format of the code?

0 Karma

mayurr98
Super Champion

yeah eval does not support *. In order to make it support you need to you eval(like()) and % works as wildcard in that command.

Refer this link, you will get an idea!
http://docs.splunk.com/Documentation/Splunk/7.0.1/SearchReference/ConditionalFunctions#like.28TEXT.2...

0 Karma

jvmerilla
Path Finder

I didn't know that.

Thank you for your help. 🙂

0 Karma

Yunagi
Communicator

I don't think that eval supports wildcards (*).

Try

eval(Status=="Closed" AND like(Resolution_Code,"Not Resolved %"))

lmonahan
Path Finder

I needed the double quotes too which I learned from your post. Thanks!

0 Karma

jvmerilla
Path Finder

Hi @Yunagi,

It works!

Thanks for your help. 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...