topic Re: How to split count of field1 where (field2=value1) and count of field1 where (field2=value2) without appending? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-split-count-of-field1-where-field2-value1-and-count-of/m-p/451132#M127761 <P>Close this worked for me</P> <PRE><CODE>| stats sum(eval(if(SE="DISCONNECTED",count_CA,0))) as disconnected_count, sum(eval(if(SE="CONNECTED",count_CA,0))) as connected_count </CODE></PRE> <P>Feel free to change your comment into an answer, I can mark it as answered.</P> Wed, 20 Mar 2019 20:36:15 GMT JoshuaJohn 2019-03-20T20:36:15Z How to split count of field1 where (field2=value1) and count of field1 where (field2=value2) without appending? https://community.splunk.com/t5/Splunk-Search/How-to-split-count-of-field1-where-field2-value1-and-count-of/m-p/451130#M127759 <P>I want to find how many times an event happens based on the value of another field. Basically a count of IP addresses when they are "Connected" or "Disconnected".</P> <P>CA is the IP address<BR /> SE is what tells me if they are connected/disconnected</P> <P>I feel like this should be simple, but I have tried a few things to no avail:</P> <PRE><CODE>| stats latest(SE) as SE by CA | stats distinct_count(CA) as count_CA by SE | stats dc(eval(if(SE=DISCONNECTED, count_CA, NULL))) AS disconnected_CA, dc(eval(if(SE=CONNECTED, count_CA, NULL))) AS connected_CA </CODE></PRE> <P>Provides 0 in both fields (Not true)</P> <PRE><CODE>| stats latest(SE) as SE by CA | eval disconnectedCheck = if(SE==DISCONNECTED, disconnected_SE, disconnectedCheck) | stats dc(CA) as disconnected_CA by disconnected_SE | stats values(disconnected_CA) </CODE></PRE> <P>No Results</P> <PRE><CODE>| stats latest(SE) as SE by CA | stats distinct_count(CA) as count_CA by SE | eventstats sum(count_CA) as total_CA | search SE = "DISCONNECTED" | eventstats values(count_CA) as disconnected_CA | search SE = "CONNECTED" | eventstats values(count_CA) as connected_CA, values(total_CA) as total_CA | eval Percentage=round((disconnected_CA/total_CA)*100,2) | table disconnected_CA, total_CA, connected_CA, Percentage </CODE></PRE> <P>No results</P> <P>Any Ideas, would prefer not to append if possible?</P> Wed, 20 Mar 2019 16:38:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-split-count-of-field1-where-field2-value1-and-count-of/m-p/451130#M127759 JoshuaJohn 2019-03-20T16:38:38Z Re: How to split count of field1 where (field2=value1) and count of field1 where (field2=value2) without appending? https://community.splunk.com/t5/Splunk-Search/How-to-split-count-of-field1-where-field2-value1-and-count-of/m-p/451131#M127760 <P>Hi,</P> <P>I didn't understand your question properly but have you tried something like this</P> <PRE><CODE>&lt;yoursearch&gt; | stats sum(eval(if(SE="DISCONNECTED",1,0))) as disconnected_count, sum(eval(if(SE="CONNECTED",1,0))) as connected_count </CODE></PRE> Wed, 20 Mar 2019 17:12:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-split-count-of-field1-where-field2-value1-and-count-of/m-p/451131#M127760 harsmarvania57 2019-03-20T17:12:14Z Re: How to split count of field1 where (field2=value1) and count of field1 where (field2=value2) without appending? https://community.splunk.com/t5/Splunk-Search/How-to-split-count-of-field1-where-field2-value1-and-count-of/m-p/451132#M127761 <P>Close this worked for me</P> <PRE><CODE>| stats sum(eval(if(SE="DISCONNECTED",count_CA,0))) as disconnected_count, sum(eval(if(SE="CONNECTED",count_CA,0))) as connected_count </CODE></PRE> <P>Feel free to change your comment into an answer, I can mark it as answered.</P> Wed, 20 Mar 2019 20:36:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-split-count-of-field1-where-field2-value1-and-count-of/m-p/451132#M127761 JoshuaJohn 2019-03-20T20:36:15Z