Hi, I have this search query where i aggregate using the stats and sum by few fields... When I run the query in splunk portal i see the data in the events tab but not in the stats tab. So I used the fillnull to see which fields are causing the problem. I noticed that these fields where i am using eval are causing the issue as i see 0 inside these columns after using fillnull | eval status_codes_only=if( (status_code>=200 and status_code<300) or status_code>=400,1,0) | search status_codes_only=1 | rex mode=sed field=ClintReqRcvdTime "s/: /:/" | eval date_only=strftime(strptime(ClintReqRcvdTime, "%a %d %b %Y %H:%M:%S :%3N %Z"), "%m/%d/%Y") | eval year_only=strftime(strptime(ClintReqRcvdTime, "%a %d %b %Y %H:%M:%S :%3N %Z"), "%Y") | eval month_only=strftime(strptime(ClintReqRcvdTime, "%a %d %b %Y %H:%M:%S :%3N %Z"), "%b") | eval week_only=floor(tonumber(strftime(strptime(ClintReqRcvdTime, "%a %d %b %Y %H:%M:%S :%3N %Z"), "%d"))/7+1) | eval TwoXXonly=if(status_code>=200 and status_code <300,1,0) | eval FourXXonly=if(status_code>=400 and status_code <500,1,0) | eval FiveXXonly=if(status_code>=500 and status_code <600,1,0) | fillnull date_only,year_only,month_only,week_only,organization,clientId,proxyBasePath,api_name,environment,Total_2xx,Total_4xx,Total_5xx | stats sum(TwoXXonly) as Total_2xx,sum(FourXXonly) as Total_4xx,sum(FiveXXonly) as Total_5xx by date_only,year_only,month_only,week_only,organization,clientId,proxyBasePath,api_name,environment | table date_only,year_only,month_only,week_only,organization,clientId,proxyBasePath,api_name,environment,Total_2xx,Total_4xx,Total_5xx   when i look at the field that i used to get the date_only, year_only, week_only column - i see data something like this in the events Wed 11 Jun 2025 22:57:34:396 EDT Wed 11 Jun 2025 22:56:43:254 EDT Wed 11 Jun 2025 22:56:34:466 EDT Wed 11 Jun 2025 22:56:28:404 EDT ... View more

Hi, I have this field in this format and i am using eval to convert but sometimes there is an extra space in it after :  Mon 2 Jun 2025 20:51:24 : 792 EDT  - with extra space after hhmmss (space before 792) Mon 2 Jun 2025 20:51:24 :792 EDT - this is another scenario where there will be no space i have to get 2 scenarios in this eval - any help | eval date_only=strftime(strptime(ClintReqRcvdTime, "%a %d %b %Y %H:%M:%S :%3N %Z"), "%m/%d/%Y")   ... View more

Hi ,  I have this scenario where i am getting data from one of the index with 2 other specified filters like index=index_logs_App989 customer="*ABC*" org in ("Provider1","Provider2") i have one filed with the date values as below Tue 27 May 2025 15:26:23:702 EDT  - from this i have to take out the time part and convert it into date like 05/27/2025  - so that i can use this to aggregate at the date or day only ... any guidance please       ... View more