Splunk Search

Multiple stats command

lkslsaks
Loves-to-Learn

 

bin _time span=1h | stats count(eval(eventDay==curDay)) AS cv by uid | stats count(eval(eventDay!=curDay)) AS ce by _time, uid 

 

The following commands returns with null value in  "cv"  @Lowell @Hazel  @ramdaspr @ITWhisperer

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is this what you are trying to do - if not, please explain what you are attempting to do (not just what doesn't work)

bin _time span=1h | stats count(eval(eventDay==curDay)) AS cv count(eval(eventDay!=curDay)) AS ce by _time, uid 
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@lkslsaks 

Your second stats will not work. Because after 1st stats there will be only cv and uid fields available in results.

bin _time span=1h | stats count(eval(eventDay==curDay)) AS cv by uid 

 

The second stats required  eventDay,curDay,_time and uid. That's Y you are not getting any results.

| stats count(eval(eventDay!=curDay)) AS ce by _time, uid

 

Please share the logic or steps for your search. So we can help you on.

KV

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...