Simple eval + stats count by 2 fields not working

[the_wolverine]

What am I doing wrong? I've tried several iterations of the following all which return 2 columns with a count of 0:

sourcetype=a  OR sourcetype=b | stats count   
   count(eval(sourcetype=a)) AS a_count   
   count(eval(sourcetype=b)) AS b_count

• "sourcetype=a OR sourcetype=b | stats count by sourcetype" <= returns the correct counts but I'm unable to split the count out for further evaluation. I need to be able to eval diff=(b_count-a_count).

[AFAS]

I was looking for this for days! Thanks the_wolverine

[shikhanshu]

Exact same situation and exact same reaction. OMG. 🙂

[the_wolverine · Accepted solution]

OMG. I got it to work by changing '=' to '==' and putting the value in quotes! HOW FICKLE!!

sourcetype=a  OR sourcetype=b | stats count  as Total
   count(eval(sourcetype=="a")) AS a_count   
   count(eval(sourcetype=="b")) AS b_count

[cmak]

So glad I found this 🙂