Splunk Search

Why is tstats command with eval not working on a particular field?

nmohammed
Builder

hi,

I am trying to combine results into two categories based of an eval statement.

The original query returns the results fine, but is slow because of large amount of results and extended time frame:

index=enc sourcetype=enc type=trace source=*123456*|  eval  Call = if(app_type="API", "sdk", "non-sdk") |  stats count by Call

I tried the following with tstats, but none of them work, meaning displayed 0 results.

| tstats count from datamodel=Enc where sourcetype=trace  Enc.type=TRACE  Enc.cid=1234567 Enc.app_type=* 
| `drop_dm_object_name("Enc")`
| eval Call=if(app_type=="API", "sdk","non-sdk") 
| stats sum(count) by Call

AND

| tstats  count from datamodel=Enc where sourcetype=enc-trace  Enc.type=TRACE  Enc.cid=1234567
| `drop_dm_object_name("Enc")` 
| eval sdk=if(app_type="API",count,0), non-sdk=if(app_type!="API",count,0) 
| stats sum(sdk) as SDK, sum(non-sdk) as NON-SDK

appreciate help and ideas from Splunkers.

Thanks

0 Karma
1 Solution

nmohammed
Builder

I was able to get the results. Realized that we were not using the actual field app_type with GROUPBY in the tstats base search .. doing the following returned the expected results and I have validated them to be true.

| tstats count from datamodel=Enc where sourcetype=trace Enc.type=TRACE Enc.cid=1234567 GROUBPBY Enc.app_type
| drop_dm_object_name("Enc")
| eval Call=if(app_type=="API", "sdk","non-sdk")
| stats sum(count) by Call

View solution in original post

0 Karma

nmohammed
Builder

I was able to get the results. Realized that we were not using the actual field app_type with GROUPBY in the tstats base search .. doing the following returned the expected results and I have validated them to be true.

| tstats count from datamodel=Enc where sourcetype=trace Enc.type=TRACE Enc.cid=1234567 GROUBPBY Enc.app_type
| drop_dm_object_name("Enc")
| eval Call=if(app_type=="API", "sdk","non-sdk")
| stats sum(count) by Call

0 Karma

jkat54
SplunkTrust
SplunkTrust

try adding prestats=true to your tstats commands.

Thats always needed if you're going to feed tstats into timechart, stats, etc.

For example:

| tstats prestats=true count from datamodel=Enc where sourcetype=trace Enc.type=TRACE Enc.cid=1234567 Enc.app_type=* 
| drop_dm_object_name("Enc")
| eval Call=if(app_type=="API", "sdk","non-sdk") 
| stats sum(count) by Call
0 Karma

nmohammed
Builder

Thanks jkat54.

adding prestats=true displays blank results with a single column non-sdk
| tstats prestats=true count from datamodel=Enc where sourcetype=trace Enc.type=TRACE Enc.cid=1234567 Enc.app_type=*
| drop_dm_object_name("Enc")
| eval Call=if(app_type=="API", "sdk","non-sdk")
| stats sum(count) by Call

results -

Call sum(count)
non-sdk

index=enc sourcetype=enc type=trace source=123456| eval Call = if(app_type="API", "sdk", "non-sdk") | stats count by Call

Call count
non-sdk 1144197
sdk 513994

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...