Need help on why my eval if statement isn't working

[mninansplunk]

Hello,  I've been researching this online for over a day and nothing seems to be working for me.  I have 2 EVAL IF statements that simply looks at the network.connectType field.  

| eval MOBILE=if(network.connectType="MOBILE","1","0")

| eval WIFI=if(network.connectType="WIFI","1","0")

I am in need of creating a table that would show the count of MOBILE, WIFI, TOTAL, by Branch.

i.e  Branch | Total | WIFI | MOBILE

I'm able to create the table, but the two evals always show the same counts as the Total count.  I can't figure out why I am doing wrong.

The search I am using is the following:

index=main "details.package"="com.siteone.mobilepro", "details.tag"="Connectivity Service", event=NoConnectivityEvent, "details.message.additionalInfo.NetworkAccessStatus"="None"
| fields network.connectType, event, userSettings.site
| eval MOBILE=if(network.connectType="MOBILE","1","0")
| eval WIFI=if(network.connectType="WIFI","1","0")
| stats values("userSettings.site") as Branch, count(event) as "Total Disconnects", count(MOBILE) as "Cellular Disconnects", count(WIFI) as "Wifi Disconnects" by "userSettings.site"
| table Branch, "Total Disconnects", "Wifi Disconnects", "Cellular Disconnects"

Any help on this would be awesome and much appreciated.

Thanks

[ITWhisperer · Accepted solution]

count(MOBILE) and count(WIFI) are merely counting the instances where the field is present (not null). Since you have set them to either 1 or 0, they are always present. Either set them to 1 or null(), or use sum(MOBILE) and sum(WIFI) instead

[mninansplunk]

Awesome, that did the trick, thank you very much for the quick help!!!

Thanks

[gcusello]

Hi @mninansplunk ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[gcusello]

Hi @mninansplunk,

sometimes ields with dot insied don't work in eval, so you have two solutions:

use quotes:

| eval MOBILE=if("network.connectType"="MOBILE","1","0")
| eval WIFI=if("network.connectType"="WIFI","1","0")

or use a rename before the eval:

| rename network.connectType AS network_connectType
| eval MOBILE=if(network_connectType="MOBILE","1","0")
| eval WIFI=if(network_connectType="WIFI","1","0")

I prefer the second solution.

Ciao.

Giuseppe