Splunk Search

nested eval with stats count not working while using Data Model

nagar57
Communicator

Below is my query:

|datamodel testing search
|search wells.API="enroll"
|stats count(eval(wells.resp_code="S" OR (wells.resp_code="F" AND wells.error_code="NGENR000"))) AS Success

wells is the nodename and resp_code and API are extracted fields in Data Model.
When I run this query with index as a normal search query it is working, but with Data model it is not.

0 Karma
1 Solution

nagar57
Communicator

I get it working by renaming the fields from "wells.resp_code" to "resp_code". I don't know why dataset name with fields not working under eval expressions.

View solution in original post

0 Karma

maraman_splunk
Splunk Employee
Splunk Employee

Hi

look in the job inspector to see how the search is expanded
try to disable search optimization
https://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutoptimization
also make sure all the fields you use are defined in the datamodel or they would be filtered out
+ try renaming your fields without nodename that is easier to work with with eval

nagar57
Communicator

I get it working by renaming the fields from "wells.resp_code" to "resp_code". I don't know why dataset name with fields not working under eval expressions.

View solution in original post

0 Karma

wgawhh5hbnht
Path Finder

It's because you removed the ".". If you wanted not rename the field you would need to add quotes around it, e.g. "wells.resp_code"="...

0 Karma

nagar57
Communicator

Can someone help?

0 Karma