topic Re: Help to get only number from Number of Files Found in Getting Data In

Help to get only number from Number of Files Found

Suganya_S — Tue, 27 Apr 2021 11:23:56 GMT

Hi Team,
My Query : index=*** kubernetes.container_name=*** cluster_id=*** "Number of Files Found"

Result will be like : Number of Files Found 2(or any number)

I need to get that number value alone, when it is > 0 the count have to be displayed as any chart. How can I edit my query to get like that. Do we have any option for that? Please suggest.
Thanks!

Re: Help to get only number from Number of Files Found

aasabatini — Tue, 27 Apr 2021 11:33:07 GMT

Hi @Suganya_S

try to use stats comand

https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Stats

index=*** kubernetes.container_name=*** cluster_id=*** "Number of Files Found" | stats count | where count > 0

Re: Help to get only number from Number of Files Found

Suganya_S — Tue, 27 Apr 2021 11:42:41 GMT

Hi @aasabatini the count of the log will always be > 0. Here I basically would like to split the log statement so as to get the number alone.

Re: Help to get only number from Number of Files Found

aasabatini — Tue, 27 Apr 2021 11:48:15 GMT

Hi @Suganya_S

if you see my example search there is a where condition to force to select the count > 0

where count > 0