Splunk Search

Simple eval + stats count by 2 fields not working

the_wolverine
Champion

What am I doing wrong? I've tried several iterations of the following all which return 2 columns with a count of 0:

sourcetype=a  OR sourcetype=b | stats count   
   count(eval(sourcetype=a)) AS a_count   
   count(eval(sourcetype=b)) AS b_count
  • "sourcetype=a OR sourcetype=b | stats count by sourcetype" <= returns the correct counts but I'm unable to split the count out for further evaluation. I need to be able to eval diff=(b_count-a_count).
Tags (1)
1 Solution

the_wolverine
Champion

OMG. I got it to work by changing '=' to '==' and putting the value in quotes! HOW FICKLE!!

sourcetype=a  OR sourcetype=b | stats count  as Total
   count(eval(sourcetype=="a")) AS a_count   
   count(eval(sourcetype=="b")) AS b_count

View solution in original post

AFAS
Explorer

I was looking for this for days! Thanks the_wolverine

0 Karma

shikhanshu
Path Finder

Exact same situation and exact same reaction. OMG. 🙂

the_wolverine
Champion

OMG. I got it to work by changing '=' to '==' and putting the value in quotes! HOW FICKLE!!

sourcetype=a  OR sourcetype=b | stats count  as Total
   count(eval(sourcetype=="a")) AS a_count   
   count(eval(sourcetype=="b")) AS b_count

cmak
Contributor

So glad I found this 🙂

0 Karma
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...