nested eval with stats count not working while using Data Model

[nagar57]

Below is my query:

|datamodel testing search
|search wells.API="enroll"
|stats count(eval(wells.resp_code="S" OR (wells.resp_code="F" AND wells.error_code="NGENR000"))) AS Success

wells is the nodename and resp_code and API are extracted fields in Data Model.
When I run this query with index as a normal search query it is working, but with Data model it is not.

[maraman_splunk]

Hi

look in the job inspector to see how the search is expanded
try to disable search optimization
https://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutoptimization
also make sure all the fields you use are defined in the datamodel or they would be filtered out
+ try renaming your fields without nodename that is easier to work with with eval

[nagar57 · Accepted solution]

I get it working by renaming the fields from "wells.resp_code" to "resp_code". I don't know why dataset name with fields not working under eval expressions.

[wgawhh5hbnht]

It's because you removed the ".". If you wanted not rename the field you would need to add quotes around it, e.g. "wells.resp_code"="...

[nagar57]

Can someone help?