Splunk Search

Why is conditional stats count not working with basic example?

Cuyose
Builder

The following query is pulled directly from the Splunk documentation and for whatever reason always returns 0, even when the search query finds the events just fine. Using the EXACT same condition within the stats eval does not work.

index=abc pe_service.action="pd notification" 
| stats count(eval(pe_service.action="pd notification")) AS alert_count
Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

index=abc pe_service.action="pd notification" 
 | stats count(eval('pe_service.action'="pd notification")) AS alert_count

View solution in original post

somesoni2
Revered Legend

Give this a try

index=abc pe_service.action="pd notification" 
 | stats count(eval('pe_service.action'="pd notification")) AS alert_count

lmonahan
Path Finder

I also did not try the single quotes around my field name. This works, thanks! Will use single quotes when there is a "dot" in the field name or other special characters.

0 Karma

Cuyose
Builder

Thanks!

Ugh, I was just looking to see how to get Splunk to recognize the field name in the eval, tried double quotes, as Splunk itself uses if you let it build the search query, but apparently you need to use single quotes with fields like that.

It would have been nice if any of the documentation mentioned that. 😞

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...