Why does stats count(eval always returns zero when partial non-existant values exist?

[ChadW]

My query:

index=primary eventType=ConnectionTest msg="network check results" | spath output=connectError details.error.connectionError | fillnull value=false connectError | dedup visitId | stats count as total, count(eval(connectError==true)) as errors

If I run this, "errors" always returns 0. However, if I run

index=primary eventType=ConnectionTest msg="network check results" | spath output=connectError details.error.connectionError | fillnull value=false connectError | dedup visitId | stats count by connectError

connectError properly returns the set of values in each bucket of connectError.

My dataset will sometimes contain the object "details.error". I tried fillnull to resolve this but that didn't work.

If I look at the Events data for the first or second query, I do see "connectError" in the "Interesting Fields" list on the left hand side.

❓How do I get the first query to work whereby I can get errors and total errors? I want to follow it up with |eval percentErrors=errors/total but I first need to get the stats to work properly.

[ITWhisperer · Accepted solution]

The count eval is comparing to a non-existent field called 'true' not to the string "true" so it never matches, hence the count of zero - try it this way

index=primary eventType=ConnectionTest msg="network check results" | spath output=connectError details.error.connectionError | fillnull value="false" connectError | dedup visitId | stats count as total, count(eval(connectError=="true")) as errors

[ChadW]

One disparate question around something I never understood. Why do I need to create an spath for this to work? In other words, instead of

count(eval(connectError=="true"))

why can't I just do

count(eval(details.error.connectionError=="true"))

[ChadW]

That did it! Thank you. I thought I tried that before but guess not.