Why does Splunk query not return Count?

[dezmadi]

Hi, I am running below query and expecting count of failureCount, warningCount in table as total count (1 row only), however it's not returning anything, Where I am going wrong?

index="deng03-cis-dev-audit" | spath PATH=data.labels.verbose_message output=verbose_message | search "data.labels.activity_type_name"="ViolationOpenEventv1" | where
(verbose_message like "%Oldest unacked message age%evt%" or verbose_message like "%Oldest unacked message age%rec%") | eval error=case(like(verbose_message,"%above the threshold of 1800.000%"), "warning", like(verbose_message,"%above the threshold of 300.000%"), "failure") | eval failureCount count by error="failure" | eval warningCount count by error="warning" | table failureCount, warningCount

[dezmadi]

Wohoo, it works, thanks for the help

[ITWhisperer · Accepted solution]

Try changing 

| eval failureCount count by error="failure" | eval warningCount count by error="warning" | table failureCount, warningCount

to

| stats count(eval(error=="failure")) as failureCount count(eval(error=="warning")) as warningCount

[dezmadi]

I am not able to print index in table while running below query

index="deng03-cis-dev-audit" | spath PATH=data.labels.verbose_message output=verbose_message | search "data.labels.activity_type_name"="ViolationOpenEventv1" | where (verbose_message like "%Oldest unacked message age%evt%" or verbose_message like "%Oldest unacked message age%rec%") | eval error=case(like(verbose_message,"%above the threshold of 1800.000%"), "warning", like(verbose_message,"%above the threshold of 300.000%"), "failure") | eval service = index | stats count(eval(error=="failure")) as failureCount count(eval(error=="warning")) as warningCount | table index failureCount warningCount

However with below query index is printed but I want index , warningCount and failureCount as well

index="deng03-cis-dev-audit" | spath PATH=data.labels.verbose_message output=verbose_message | search "data.labels.activity_type_name"="ViolationOpenEventv1" | where (verbose_message like "%Oldest unacked message age%evt%" or verbose_message like "%Oldest unacked message age%rec%") | eval error=case(like(verbose_message,"%above the threshold of 1800.000%"), "warning", like(verbose_message,"%above the threshold of 300.000%"), "failure") | eval service = index | table index

[ITWhisperer]

| stats count(eval(error=="failure")) as failureCount count(eval(error=="warning")) as warningCount

only has two fields on output, failureCount and warningCount i.e. the two fields mentioned in the command.

If you want index to be available after the stats command, it has to be included

| stats count(eval(error=="failure")) as failureCount count(eval(error=="warning")) as warningCount values(index) as index