I'm new to Splunk - be kind... I can produce a table where I can get: Field1 Field2 Field3 Field4.... Computer true false true false 192.168.1.1 false true true false 192.168.1.2 etc. What I'm trying to do is get just the count of 'true' per field, e.g.: Field1: 1 Field2: 1 Field3: 2 Field4: 0 I've tried: query | stats count(eval(match(Field1,true))) as F1, count(eval(match(Field2,"true"))) as F2, etc. All Fields return Zero (0) query | stats count(eval(match(Field1,true))) as F1, count(eval(match(Field2,"true"))) as F2, etc. by Computer. All Fields return Zero (0) query |stats count(eval(Field1=true)) as F1, count(eval(Field2=true) as F2, etc. Still, nada - zero(0)s. query |stats count(if(Field1=true)) as F1.... What am I missing? I've spent hours trying to figure this out. Cheers, -T ... View more