Splunk Search

Why is conditional stats count not working with basic example?

Cuyose
Builder

The following query is pulled directly from the Splunk documentation and for whatever reason always returns 0, even when the search query finds the events just fine. Using the EXACT same condition within the stats eval does not work.

index=abc pe_service.action="pd notification" 
| stats count(eval(pe_service.action="pd notification")) AS alert_count
Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

index=abc pe_service.action="pd notification" 
 | stats count(eval('pe_service.action'="pd notification")) AS alert_count

View solution in original post

somesoni2
Revered Legend

Give this a try

index=abc pe_service.action="pd notification" 
 | stats count(eval('pe_service.action'="pd notification")) AS alert_count

lmonahan
Path Finder

I also did not try the single quotes around my field name. This works, thanks! Will use single quotes when there is a "dot" in the field name or other special characters.

0 Karma

Cuyose
Builder

Thanks!

Ugh, I was just looking to see how to get Splunk to recognize the field name in the eval, tried double quotes, as Splunk itself uses if you let it build the search query, but apparently you need to use single quotes with fields like that.

It would have been nice if any of the documentation mentioned that. 😞

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...