Using "stats count by" after "case eval", why am I not getting any results?

[tungntran]

Hello,

I'm trying to change a value of a field using eval case then do a stats count based on that field. I'm getting no results.

In the code below I'm searching for an event with 2 specific field values, then alter the value to something meaningful then attempt to do a stats enter code here on it.

index=myindex sourcetype=mysourcetype

(action.objectType=core.user_auth.login_success OR action.objectType=core.user_auth.login_failed) |
eval status=case(action.objectType==core.user_auth.login_success,"Login Successful",action.objectType==core.user_auth.login_failed,"Login Failed")|
stats count by status

The closest Splunk answer I can find is this https://answers.splunk.com/answers/98575/unable-to-use-case-with-stats.html?utm_source=typeahead&utm... but still not returning any results. What am I doing wrong? I verified the field "action.objectType" exists with the values I'm checking for.

Thanks,

[somesoni2 · Accepted solution]

Give this a try

index=myindex sourcetype=mysourcetype (action.objectType="core.user_auth.login_success" OR action.objectType="core.user_auth.login_failed") |
 eval status=case('action.objectType'="core.user_auth.login_success","Login Successful",'action.objectType'="core.user_auth.login_failed","Login Failed")|
 stats count by status

changes
1) the field name with special character (other than underscore) will need to be single quotes when using in eval and where expressions.
2) the string values that you need to compare against should be in double quotes in eval and where expressions

[tungntran]

Dude, that's it! thank you for the explanation on the single quote.