Splunk Search

Issue with stats count(eval()) command

Path Finder

Hi,

I have this query:

index="sample_data" sourcetype="analytics_sampledata.csv" 
| rename "Resolution Code" as Resolution_Code
| stats count(eval(Status!="Closed")) as "Open Tickets", count(eval(Status="Closed" AND Resolution_Code="Not Resolved *")) as "Closed/Not Resolved Tickets"

And this is the result:
alt text

I don't know what could be wrong with query but the second eval is not returning any value.

I hope anyone would shed a light on this.

Thank you.

0 Karma
1 Solution

Communicator

I don't think that eval supports wildcards (*).

Try

eval(Status=="Closed" AND like(Resolution_Code,"Not Resolved %"))

View solution in original post

SplunkTrust
SplunkTrust

hey @jvmerilla

Try this,
index="sample_data" sourcetype="analytics_sampledata.csv"
| rename "Resolution Code" as Resolution_Code
| stats count(eval(Status!="Closed")) as "Open Tickets", count(eval((like(Resolution_Code,"Not Resolved%")) AND Status="Closed")) as "Closed/Not Resolved Tickets"

Let me know if it helps!

Path Finder

Hi @mayurr98,

It also works.
Thank you. 🙂

So the main cause of the error is the *, and also the format of the code?

0 Karma

SplunkTrust
SplunkTrust

yeah eval does not support *. In order to make it support you need to you eval(like()) and % works as wildcard in that command.

Refer this link, you will get an idea!
http://docs.splunk.com/Documentation/Splunk/7.0.1/SearchReference/ConditionalFunctions#like.28TEXT.2...

0 Karma

Path Finder

I didn't know that.

Thank you for your help. 🙂

0 Karma

Communicator

I don't think that eval supports wildcards (*).

Try

eval(Status=="Closed" AND like(Resolution_Code,"Not Resolved %"))

View solution in original post

Path Finder

Hi @Yunagi,

It works!

Thanks for your help. 🙂

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!