Splunk Search

Issue with stats count(eval()) command

Path Finder

Hi,

I have this query:

index="sample_data" sourcetype="analytics_sampledata.csv" 
| rename "Resolution Code" as Resolution_Code
| stats count(eval(Status!="Closed")) as "Open Tickets", count(eval(Status="Closed" AND Resolution_Code="Not Resolved *")) as "Closed/Not Resolved Tickets"

And this is the result:
alt text

I don't know what could be wrong with query but the second eval is not returning any value.

I hope anyone would shed a light on this.

Thank you.

0 Karma
1 Solution

Communicator

I don't think that eval supports wildcards (*).

Try

eval(Status=="Closed" AND like(Resolution_Code,"Not Resolved %"))

View solution in original post

SplunkTrust
SplunkTrust

hey @jvmerilla

Try this,
index="sample_data" sourcetype="analytics_sampledata.csv"
| rename "Resolution Code" as Resolution_Code
| stats count(eval(Status!="Closed")) as "Open Tickets", count(eval((like(Resolution_Code,"Not Resolved%")) AND Status="Closed")) as "Closed/Not Resolved Tickets"

Let me know if it helps!

Path Finder

Hi @mayurr98,

It also works.
Thank you. 🙂

So the main cause of the error is the *, and also the format of the code?

0 Karma

SplunkTrust
SplunkTrust

yeah eval does not support *. In order to make it support you need to you eval(like()) and % works as wildcard in that command.

Refer this link, you will get an idea!
http://docs.splunk.com/Documentation/Splunk/7.0.1/SearchReference/ConditionalFunctions#like.28TEXT.2...

0 Karma

Path Finder

I didn't know that.

Thank you for your help. 🙂

0 Karma

Communicator

I don't think that eval supports wildcards (*).

Try

eval(Status=="Closed" AND like(Resolution_Code,"Not Resolved %"))

View solution in original post

Path Finder

Hi @Yunagi,

It works!

Thanks for your help. 🙂

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!