I have logs in the format of json where message is the key and message contains the value mentioned below   message:  <ErrorMessage>E-delivery failed<ErrorMessage> When i am searching like below in the splunk, able to search the events index="*" source="*" "E-delivery failed" If i want to display the count of E-delivery failed string, the results are not fetching as the value under message tag is xml. Query used is: index="*" source="*" | eval type=case(like(message, "%E-delivery failed%"),"e delivery failed")|stats count as Results by type With the above query not able to get any results. Please help me with the query.   Result should be: type                                  count e delivery failed             10   ... View more

My query is : index="stage*" source="*record service*" | eval type=case(like(message, "%successful generated account%"),"Success Accounts", like(message, "%Granting failed Accounts%"),"Granting failed Accounts", like(message, "%Inbound setup failed accounts%"),"Inbound  failed Accounts")| stats count as Results by type I am getting the result as: type                                               Results Success Accounts                   10 Granting failed Accounts       20   I am unable to get the results for the string  Inbound failed Accounts as the results are zero. I need the output as  type                                               Results Success Accounts                   10 Granting failed Accounts       20 Inbound  failed Accounts         0   Please help me with the query for displaying the strings with zero count as well   ... View more