Splunk Search

Why does Splunk query not return Count?

dezmadi
Path Finder

Hi, I am running below query and expecting count of failureCount, warningCount in table as total count (1 row only), however it's not returning anything, Where I am going wrong?

 

index="deng03-cis-dev-audit" | spath PATH=data.labels.verbose_message output=verbose_message | search "data.labels.activity_type_name"="ViolationOpenEventv1" | where
(verbose_message like "%Oldest unacked message age%evt%" or verbose_message like "%Oldest unacked message age%rec%") | eval error=case(like(verbose_message,"%above the threshold of 1800.000%"), "warning", like(verbose_message,"%above the threshold of 300.000%"), "failure") | eval failureCount count by error="failure" | eval warningCount count by error="warning" | table failureCount, warningCount
Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try changing 

| eval failureCount count by error="failure" | eval warningCount count by error="warning" | table failureCount, warningCount

to

| stats count(eval(error=="failure")) as failureCount count(eval(error=="warning")) as warningCount

View solution in original post

0 Karma

dezmadi
Path Finder

Wohoo, it works, thanks for the help

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try changing 

| eval failureCount count by error="failure" | eval warningCount count by error="warning" | table failureCount, warningCount

to

| stats count(eval(error=="failure")) as failureCount count(eval(error=="warning")) as warningCount
0 Karma

dezmadi
Path Finder

I am not able to print index in table while running below query

index="deng03-cis-dev-audit" | spath PATH=data.labels.verbose_message output=verbose_message | search "data.labels.activity_type_name"="ViolationOpenEventv1" | where (verbose_message like "%Oldest unacked message age%evt%" or verbose_message like "%Oldest unacked message age%rec%") | eval error=case(like(verbose_message,"%above the threshold of 1800.000%"), "warning", like(verbose_message,"%above the threshold of 300.000%"), "failure") | eval service = index | stats count(eval(error=="failure")) as failureCount count(eval(error=="warning")) as warningCount | table index failureCount warningCount

 

However with below query index is printed but I want index , warningCount and failureCount as well

index="deng03-cis-dev-audit" | spath PATH=data.labels.verbose_message output=verbose_message | search "data.labels.activity_type_name"="ViolationOpenEventv1" | where (verbose_message like "%Oldest unacked message age%evt%" or verbose_message like "%Oldest unacked message age%rec%") | eval error=case(like(verbose_message,"%above the threshold of 1800.000%"), "warning", like(verbose_message,"%above the threshold of 300.000%"), "failure") | eval service = index | table index

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats count(eval(error=="failure")) as failureCount count(eval(error=="warning")) as warningCount

only has two fields on output, failureCount and warningCount i.e. the two fields mentioned in the command.

If you want index to be available after the stats command, it has to be included

| stats count(eval(error=="failure")) as failureCount count(eval(error=="warning")) as warningCount values(index) as index
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...