Splunk Search

Unable to use case with stats

Path Finder

Hi Everyone, I am not able to use eval command with stats. I am using the following search in a form, I want to find the sum of a field depending on the action selected from drop down. I am using the eval command to find the field but not able the pass the same to stats command.

Any help is much appreciated..

sourcetype=brmbatchdata ACTION=$ACTIONSELECTED$ | eval actionval = case (ACTION == "INVOICING", "BILLDUE", ACTION == "BILLING", "AMOUNT", ACTION="PAYMENT", "AMOUNT") | stats sum(actionval)

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Well, since actionval is not a number, it is not meaningful to try sum it, obviously. Perhaps you have fields/variables named BILLDUE and AMOUNT, in which case all you need to do is remove the quotes from around the names in your case() expression to fix it.

 sourcetype=brm_batch_data ACTION=$ACTION_SELECTED$  | eval action_val = case (ACTION == "INVOICING", BILL_DUE, ACTION == "BILLING", AMOUNT, ACTION="PAYMENT", AMOUNT) | stats sum(action_val)

View solution in original post

Splunk Employee
Splunk Employee

Well, since actionval is not a number, it is not meaningful to try sum it, obviously. Perhaps you have fields/variables named BILLDUE and AMOUNT, in which case all you need to do is remove the quotes from around the names in your case() expression to fix it.

 sourcetype=brm_batch_data ACTION=$ACTION_SELECTED$  | eval action_val = case (ACTION == "INVOICING", BILL_DUE, ACTION == "BILLING", AMOUNT, ACTION="PAYMENT", AMOUNT) | stats sum(action_val)

View solution in original post

Path Finder

thanks gkanapathy. it worked....

0 Karma