Why are we getting different results from "count eval if" and "count eval"?

[charlix]

Seeing different results when performing similiar searches and not sure on the reason. 

base search is the same for both 

|timechart span=5m count(eval(if(event=="Started",total,0))) as "started, count (eval(if(event =="Completed",total,0))) as "completed" 
|eval divergence = completed-started


second search is 
|timechart span=5m count(eval(event=="Started")) as "started, count (eval(event =="Completed")) as "completed" 
|eval divergence = completed-started

 they both produce same results but reversed:

first query 

time	started	completed	divergence
time	18499	18517	18
time	18426	18422	-4

second query

time	started	completed	divergence
time	18517	18499	-18
time	18422	18426	4

any help will be appreciated  

[PickleRick · Accepted solution]

What is your total field?

stats(agg(eval(...))) is just a shorthand for eval temp=(...) | stats agg(temp)

So I suspect your total field has no value. In such case, the fields will _not_ be counted since the output of your eval-ed condition will amount to the value of the total field which is null. And count does not count null fields.

The docs were lately improved but before that the only example that showed stats with eval used count with eval defaulting to 0 so it indeed "wouldn't" sum some of the events. But that introduced a wrong idea about how stats with eval work so now this docs part is reworked with the more elaborate description.

[ITWhisperer]

count(expression) is counting events where expression is non-null

The if statement is returning total if the expression is true.

If total does not exist in the event, null will be returned.

This is why your results are reversed.