https://community.splunk.com/t5/Splunk-Search/How-to-search-multiple-counts-based-on-fields-condition-using/m-p/487824#M136290 <P>Hi @avni26 </P> <P>This rightly does not work and here's why.</P> <P>The first two commands albeit looking through multiple field values returns one single aggregated value whereas the values is expected to return one single multi value field of restore_duration values for Sev1 scenarios.</P> <P>The below run anywhere example should work for you by virtue of creating the additional duration field. You should be able to customize it to work for your example. If you need to create a multivalue field(which is a complication), use streamstats to create a field based on severity ahead of your stats</P> <PRE><CODE>| makeresults count=10 | streamstats count | eval status=if(count%2&gt;0,"true","false") , severity=if(count%2&gt;0,2,1),restore_duration=if(count%2&gt;0,25,30), duration=if(severity=1,restore_duration,null()) | stats count as total_count count(eval(status="true")) as status_count avg(duration) as duration </CODE></PRE> Thu, 19 Sep 2019 15:29:15 GMT vik_splunk 2019-09-19T15:29:15Z https://community.splunk.com/t5/Splunk-Search/How-to-search-multiple-counts-based-on-fields-condition-using/m-p/487822#M136288 <P>There are multiple fields like <BR /> time number description severity status restore_duration<BR /> I want to take total count , count when status has true value , values of restore_duration when severity is 1.<BR /> I am trying with stats command like below, but for 3rd requirement its not working</P> <P>| stats count as total_count count(eval(status="true")) as status_count values(eval(if(severity="1",restore_duration,null))) as duration </P> <P>Please suggest, how to achieve when severity=1, then get the values of restore_duration using same stats.<BR /> After taking values from restore_duration , i have to calculate average of duration also.</P> Wed, 30 Sep 2020 02:18:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-multiple-counts-based-on-fields-condition-using/m-p/487822#M136288 avni26 2020-09-30T02:18:05Z https://community.splunk.com/t5/Splunk-Search/How-to-search-multiple-counts-based-on-fields-condition-using/m-p/487823#M136289 <P>Hi,<BR /> Instead putting the if condition in stats , have the eval if condition before stats sepatly and try </P> <P>|eval duration=if((severity="1"),restore_duration,null)<BR /> | stats count as total_count, count(eval(status="true")) as status_count</P> Wed, 30 Sep 2020 02:14:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-multiple-counts-based-on-fields-condition-using/m-p/487823#M136289 Anantha123 2020-09-30T02:14:00Z https://community.splunk.com/t5/Splunk-Search/How-to-search-multiple-counts-based-on-fields-condition-using/m-p/487824#M136290 <P>Hi @avni26 </P> <P>This rightly does not work and here's why.</P> <P>The first two commands albeit looking through multiple field values returns one single aggregated value whereas the values is expected to return one single multi value field of restore_duration values for Sev1 scenarios.</P> <P>The below run anywhere example should work for you by virtue of creating the additional duration field. You should be able to customize it to work for your example. If you need to create a multivalue field(which is a complication), use streamstats to create a field based on severity ahead of your stats</P> <PRE><CODE>| makeresults count=10 | streamstats count | eval status=if(count%2&gt;0,"true","false") , severity=if(count%2&gt;0,2,1),restore_duration=if(count%2&gt;0,25,30), duration=if(severity=1,restore_duration,null()) | stats count as total_count count(eval(status="true")) as status_count avg(duration) as duration </CODE></PRE> Thu, 19 Sep 2019 15:29:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-multiple-counts-based-on-fields-condition-using/m-p/487824#M136290 vik_splunk 2019-09-19T15:29:15Z https://community.splunk.com/t5/Splunk-Search/How-to-search-multiple-counts-based-on-fields-condition-using/m-p/487825#M136291 <P>@Anantha123 Thank you. It perfectly worked for me</P> Thu, 19 Sep 2019 16:55:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-multiple-counts-based-on-fields-condition-using/m-p/487825#M136291 avni26 2019-09-19T16:55:52Z