This is a repost from the forums and includes the question AND THE ANSWER!</p>
QUESTION:
I have an event defined like this in eventtype.conf:
[SOME_EVENT]
search= index=SOME_INDEX (SOME_OTHER_FIELD=A OR SOME_OTHER_FIELD=B OR SOME_OTHER_FIELD=C)
If I search like this, it works:
index=SOME_INDEX | stats sum(eval(if((SOME_OTHER_FIELD==A OR SOME_OTHER_FIELD==B OR SOME_OTHER_FIELD==C),SOME_FIELD,0))) as SOME_TOTAL
But if I search like this, it doesn't:
index=SOME_INDEX | stats sum(eval(if(eventtype==SOME_EVENT,SOME_FIELD,0))) as SOME_TOTAL
For the sake of clarity and supportability (the "OR" clause will continue to grow for this event type), I need to avoid the iteration and use the eventtype.
For reference:
http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions">http://www.s...
Your fields are numeric, and eventtypes are strings, which means you need to quote them in eval clauses; sure enough, this works:
index=SOME_INDEX | stats sum(eval(if(eventtype=="SOME_EVENT",SOME_FIELD,0))) as SOME_TOTAL
Your fields are numeric, and eventtypes are strings, which means you need to quote them in eval clauses; sure enough, this works:
index=SOME_INDEX | stats sum(eval(if(eventtype=="SOME_EVENT",SOME_FIELD,0))) as SOME_TOTAL
It is fine to answer your own question, but please do so in an actual answer. Please edit your question, remove the answer part, and post an actual answer to the question that can then be accepted. Thanks!
Edited/Done.