topic Re: Problem with the summation in chart command in SPLUNK in Splunk Search

Problem with the summation in chart command in SPLUNK

abhayneilam — Mon, 28 Sep 2020 13:27:43 GMT

Hi,

I want to find out how what is the total number of "Exit" and "Entry" for the particular CARD_NUMBER for a particular TRANSIT_DATE, for that to do I gave the below query, but it is not returning my any answer,

Please let me know where I am doing wrong with the query or any other alternative is there :

chart count((eval(STR_DIRECTION="Entry"))+(eval(STR_DIRECTION="Exit"))) as "Total_Count" over "TRANSIT_DATE" by "CARD_NUMBER"

Thanks in Advance!!

Re: Problem with the summation in chart command in SPLUNK

jonuwz — Thu, 07 Mar 2013 08:15:21 GMT

This :

((eval(STR_DIRECTION="Entry"))+(eval(STR_DIRECTION="Exit"))

assuming that only 1 statement can be true, will never return anything.

It evaluates to NULL + 1 or 1 + NULL, which is always null

i.e.

* | head 1 | eval a=NULL | eval b=1 | eval c=a+b | table a b c

So you need an if statement to return sane values:

( (eval(if(STR_DIRECTION=="Entry",1,0))) + (eval(if(STR_DIRECTION=="Exit",1,0))) )

There's probably a far easier way to do this if you post some sample data though

Update

... | stats count(eval(STR_DIRECTION=="Exit")) as Exit count(eval(STR_DIRECTION=="Entry")) as Entry by TRANSIT_DATE CARD_NUMBER
    | eval Complete=if(Exit==Entry,"Complete","Incomplete")

Re: Problem with the summation in chart command in SPLUNK

abhayneilam — Thu, 07 Mar 2013 08:41:18 GMT

How do I compare the number of entry and exit of each Card_Number against each date, if num of entry is not equal to num of entry for a particular day it means , transaction is incomplete

please help

Re: Problem with the summation in chart command in SPLUNK

jonuwz — Thu, 07 Mar 2013 09:38:20 GMT

This has nothing to do with the original question, also, without sample data this comment is gibberish to me.

Re: Problem with the summation in chart command in SPLUNK

abhayneilam — Thu, 07 Mar 2013 09:57:51 GMT

I have a report which contains few columns as "Date", "Card_num","Status"

I have the "Date" in %d/%m/%Y format
"Card_num" is a numeric field ( Unique value )
"Status" Contains two values,either "Entry" or "Exit"

Now, I would like to know for a particular "Card_num" for a particular "Date" , total number of "Exit" is equal to the total number of "Entry" or not, if it is equal I should make an another column as "Result" and value should be "Complete Transaction" and for unequal number It "Result" should contain "Incomplete Transaction"

Please help !!

Re: Problem with the summation in chart command in SPLUNK

abhayneilam — Mon, 28 Sep 2020 13:27:51 GMT

I have given this code , but it gives me some different answer, I want to compare the number of exit with the number or entry for a particular Card_num for a particular day

|inputlookup "Data-Sample.csv" | table "TRANSIT_DATE","NAME","SURNAME","IDENTIFIER","CARD_NUMBER","STR_DIRECTION","STR_TRANSIT_STATUS","TERMINAL" | chart limit=29 count(eval(STR_DIRECTION="Entry" OR STR_DIRECTION="Exit")) as "Total_Count" over "TRANSIT_DATE" by "CARD_NUMBER" |eval a=strptime(TRANSIT_DATE,"%d/%m/%Y") | sort a | fields - a

Re: Problem with the summation in chart command in SPLUNK

jonuwz — Thu, 07 Mar 2013 11:30:29 GMT

updated answer