Splunk Search

Why is conditional stats count not working with basic example?

Cuyose
Builder

The following query is pulled directly from the Splunk documentation and for whatever reason always returns 0, even when the search query finds the events just fine. Using the EXACT same condition within the stats eval does not work.

index=abc pe_service.action="pd notification" 
| stats count(eval(pe_service.action="pd notification")) AS alert_count
Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

index=abc pe_service.action="pd notification" 
 | stats count(eval('pe_service.action'="pd notification")) AS alert_count

View solution in original post

somesoni2
Revered Legend

Give this a try

index=abc pe_service.action="pd notification" 
 | stats count(eval('pe_service.action'="pd notification")) AS alert_count

lmonahan
Path Finder

I also did not try the single quotes around my field name. This works, thanks! Will use single quotes when there is a "dot" in the field name or other special characters.

0 Karma

Cuyose
Builder

Thanks!

Ugh, I was just looking to see how to get Splunk to recognize the field name in the eval, tried double quotes, as Splunk itself uses if you let it build the search query, but apparently you need to use single quotes with fields like that.

It would have been nice if any of the documentation mentioned that. 😞

0 Karma
Get Updates on the Splunk Community!

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...

Alerting Best Practices: How to Create Good Detectors

At their best, detectors and the alerts they trigger notify teams when applications aren’t performing as ...

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...