Why do I have to use eval for this search?

[adamfrisbee]

Hi everyone, 

Why does this search return nothing

| stats count(status=200) AS Success

While this search returns what I expect?

| stats count(eval(status=200)) AS success

[anilchaithu]

@adamfrisbee 

In the first SPL there is no field named "status=200". So it fails.

| stats count(status=200) AS Success

The second one has eval nested in, which is equivalent to create a new filed with status=200. So now the stats count the new field.

| stats count(eval(status=200)) AS success

Hope this helps

[richgalloway · Accepted solution]

| stats count(eval(status=200))

does NOT create a new field nor does it assign a value to a field.  It merely examines the existing 'status' field in the event and returns 1 (true) if that value is 200 or 0 (zero) (false) if it is something else.  The count function then tabulates the eval results.

Note: stats count(eval(status=200)) may yield unexpected results when status<>200.  Compare it to stats sum(eval(status=200))

[adamfrisbee]

I thought `eval` always created a new field? 

Why does it not in this case?

[richgalloway]

I guess you could say eval works differently within the stats command.  Run this query to see for yourself.

| makeresults | eval status=404 
| stats count(eval(status=200)) as count, values(status) as status 
| table count status

 You should get "0  404" as the result, showing the eval function had no effect on the status field.

[richgalloway]

The eval function says the argument to count is an expression rather than a field.