Why is conditional stats count not working with basic example?

[Cuyose]

The following query is pulled directly from the Splunk documentation and for whatever reason always returns 0, even when the search query finds the events just fine. Using the EXACT same condition within the stats eval does not work.

index=abc pe_service.action="pd notification" 
| stats count(eval(pe_service.action="pd notification")) AS alert_count

[somesoni2 · Accepted solution]

Give this a try

index=abc pe_service.action="pd notification" 
 | stats count(eval('pe_service.action'="pd notification")) AS alert_count

[lmonahan]

I also did not try the single quotes around my field name. This works, thanks! Will use single quotes when there is a "dot" in the field name or other special characters.

[Cuyose]

Thanks!

Ugh, I was just looking to see how to get Splunk to recognize the field name in the eval, tried double quotes, as Splunk itself uses if you let it build the search query, but apparently you need to use single quotes with fields like that.

It would have been nice if any of the documentation mentioned that. 😞