topic Re: Is it possible to use if else condition based on the search to create stats? in Splunk Search

Is it possible to use if else condition based on the search to create stats?

nukarajusundeep — Wed, 30 Oct 2019 19:03:10 GMT

index=concourse
sourcetype="deployments: csv"
if project = * and team=$team$ | stats count by project, team
elif team=* and project=$project$ | stats count by team, project

Can we do something like this in Splunk search?

Re: Is it possible to use if else condition based on the search to create stats?

dmarling — Wed, 30 Oct 2019 19:27:03 GMT

Where is the data that is going to populate the two tokens you have in your search coming from? Is that streaming from the search that returns with your index=concourse sourcetype="deployments: csv" part of the query? Also what is your ultimate goal, Are you trying to say, if project is not null and team equals token team stats count by project, team, else if team is not null and project equals token project stats count by team project? Are you doing this because the project/team field is sometimes null? Can you mock up the output you are looking for?

Re: Is it possible to use if else condition based on the search to create stats?

nukarajusundeep — Wed, 30 Oct 2019 19:44:44 GMT

I am trying to create a dashboard with deployments during the month based on projects as dropdown fields using Column graph

this is my query for the dashboard.

index="concourse" sourcetype="deployments: csv" month="$mt$" project="$project$" | stats count by project, month

This basically gives me the count for the deployments by project

with the above query if i choose
Project = ALL and Month=February

This is basically showing the data correctly in the graph wit proper name [like a, b, c projects deployed during this month]

When I choose Project=BUY and Month=ALL
Then it is populating the results but showing as [BUY,BUY,BUY,BUY] on x-axis and count on y-axis and not displaying the month

Re: Is it possible to use if else condition based on the search to create stats?

dmarling — Wed, 30 Oct 2019 20:03:22 GMT

Gotcha. You may want to consider using chart instead of stats for this use case:

index="concourse" sourcetype="deployments: csv" month="$mt$" project="$project$"
| chart count over month by project

This will make it so month is always the x-axis and your columns will be different projects.

Re: Is it possible to use if else condition based on the search to create stats?

anthonymelita — Wed, 30 Oct 2019 21:35:50 GMT

I'm not sure if it will get you what you need, but you can wrap an eval inside of a stats function.
count(eval(team=$team$ AND project=*))