Splunk Search

Why is conditional stats count not working with basic example?

Cuyose
Builder

The following query is pulled directly from the Splunk documentation and for whatever reason always returns 0, even when the search query finds the events just fine. Using the EXACT same condition within the stats eval does not work.

index=abc pe_service.action="pd notification" 
| stats count(eval(pe_service.action="pd notification")) AS alert_count
Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

index=abc pe_service.action="pd notification" 
 | stats count(eval('pe_service.action'="pd notification")) AS alert_count

View solution in original post

somesoni2
Revered Legend

Give this a try

index=abc pe_service.action="pd notification" 
 | stats count(eval('pe_service.action'="pd notification")) AS alert_count

lmonahan
Path Finder

I also did not try the single quotes around my field name. This works, thanks! Will use single quotes when there is a "dot" in the field name or other special characters.

0 Karma

Cuyose
Builder

Thanks!

Ugh, I was just looking to see how to get Splunk to recognize the field name in the eval, tried double quotes, as Splunk itself uses if you let it build the search query, but apparently you need to use single quotes with fields like that.

It would have been nice if any of the documentation mentioned that. 😞

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...