Splunk Search

count eval results doesn't match the results under the Events tab

rarbabi
New Member

I have a simple search with stats count eval (u_id is a numeric field):

index=myindex base search | stats count(eval(u_id=1234)) as total

The count which I see under "total" (under Statistics tab) does not match the number under Events tab.It seems the eval function is not performing right. But when I do the following search both number matches.

index=myindex base search u_id=1234| stats count as total

what's wrong with the first search?

0 Karma
1 Solution

gvmorley
Contributor

Hi,

I would guess it's because in your first search, the count in the Events tab is showing all of the events returned by the base search. You're then using a transforming command (stats) to produce your result.

In the second search, you're filtering the events as part of that search (using the u_id=1234). So the count in the Events tab will be reduced.

For example if I do this:

index=_internal | stats count(eval(sourcetype="splunkd")) as total

I'll get:

alt text

But if I do this:

index=_internal sourcetype="splunkd" | stats count as total

I get:

alt text

Whilst it's not 'strictly' true, you could think of the count in the Events tab as showing you the number of events your actual search returned, before applying any sort of transformation. Such as stats, chart, etc.

Does that make sense?

View solution in original post

0 Karma

gvmorley
Contributor

Hi,

I would guess it's because in your first search, the count in the Events tab is showing all of the events returned by the base search. You're then using a transforming command (stats) to produce your result.

In the second search, you're filtering the events as part of that search (using the u_id=1234). So the count in the Events tab will be reduced.

For example if I do this:

index=_internal | stats count(eval(sourcetype="splunkd")) as total

I'll get:

alt text

But if I do this:

index=_internal sourcetype="splunkd" | stats count as total

I get:

alt text

Whilst it's not 'strictly' true, you could think of the count in the Events tab as showing you the number of events your actual search returned, before applying any sort of transformation. Such as stats, chart, etc.

Does that make sense?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...