Splunk Search

Why is tstats command with eval not working on a particular field?

nmohammed
Contributor

hi,

I am trying to combine results into two categories based of an eval statement.

The original query returns the results fine, but is slow because of large amount of results and extended time frame:

index=enc sourcetype=enc type=trace source=*123456*|  eval  Call = if(app_type="API", "sdk", "non-sdk") |  stats count by Call

I tried the following with tstats, but none of them work, meaning displayed 0 results.

| tstats count from datamodel=Enc where sourcetype=trace  Enc.type=TRACE  Enc.cid=1234567 Enc.app_type=* 
| `drop_dm_object_name("Enc")`
| eval Call=if(app_type=="API", "sdk","non-sdk") 
| stats sum(count) by Call

AND

| tstats  count from datamodel=Enc where sourcetype=enc-trace  Enc.type=TRACE  Enc.cid=1234567
| `drop_dm_object_name("Enc")` 
| eval sdk=if(app_type="API",count,0), non-sdk=if(app_type!="API",count,0) 
| stats sum(sdk) as SDK, sum(non-sdk) as NON-SDK

appreciate help and ideas from Splunkers.

Thanks

0 Karma
1 Solution

nmohammed
Contributor

I was able to get the results. Realized that we were not using the actual field app_type with GROUPBY in the tstats base search .. doing the following returned the expected results and I have validated them to be true.

| tstats count from datamodel=Enc where sourcetype=trace Enc.type=TRACE Enc.cid=1234567 GROUBPBY Enc.app_type
| drop_dm_object_name("Enc")
| eval Call=if(app_type=="API", "sdk","non-sdk")
| stats sum(count) by Call

View solution in original post

0 Karma

nmohammed
Contributor

I was able to get the results. Realized that we were not using the actual field app_type with GROUPBY in the tstats base search .. doing the following returned the expected results and I have validated them to be true.

| tstats count from datamodel=Enc where sourcetype=trace Enc.type=TRACE Enc.cid=1234567 GROUBPBY Enc.app_type
| drop_dm_object_name("Enc")
| eval Call=if(app_type=="API", "sdk","non-sdk")
| stats sum(count) by Call

0 Karma

jkat54
SplunkTrust
SplunkTrust

try adding prestats=true to your tstats commands.

Thats always needed if you're going to feed tstats into timechart, stats, etc.

For example:

| tstats prestats=true count from datamodel=Enc where sourcetype=trace Enc.type=TRACE Enc.cid=1234567 Enc.app_type=* 
| drop_dm_object_name("Enc")
| eval Call=if(app_type=="API", "sdk","non-sdk") 
| stats sum(count) by Call
0 Karma

nmohammed
Contributor

Thanks jkat54.

adding prestats=true displays blank results with a single column non-sdk
| tstats prestats=true count from datamodel=Enc where sourcetype=trace Enc.type=TRACE Enc.cid=1234567 Enc.app_type=*
| drop_dm_object_name("Enc")
| eval Call=if(app_type=="API", "sdk","non-sdk")
| stats sum(count) by Call

results -

Call sum(count)
non-sdk

index=enc sourcetype=enc type=trace source=123456| eval Call = if(app_type="API", "sdk", "non-sdk") | stats count by Call

Call count
non-sdk 1144197
sdk 513994

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...