topic Re: Count To Boolean in Splunk Search

Count To Boolean

sharadrk — Thu, 25 Jun 2020 07:56:38 GMT

Hi All,

I have a requirement wherein I count a specific log in the last minute. The count is supposed to be 1.

I need to convert this count to boolean to show in my visualization. Something like, if count = 1 then True else False.

I need only true or false as output of the query and not with count.

I'm basically trying to create a application status monitoring! Any pointers?

Regards,

Sharad R K

Re: Count To Boolean

rnowitzki — Thu, 25 Jun 2020 08:19:44 GMT

Hi @sharadrk ,

Is this what you are looking for?

| eval countflag = if(count=1, "true", "false")

("countflag" can be anything, you could eve overwrite the count field itself.)

It's not really boolean, just the strings "true" or "false". In the Documentation it says "The result of an eval expression cannot be a Boolean." But you should be able to work with that way.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval

Re: Count To Boolean

sharadrk — Thu, 25 Jun 2020 08:41:55 GMT

But the thing is if I use this concept, I get output in a table with Count and then countflag.

That is not what I wanted. I just wanted True or False. How can I not show count and only show countflag?

Re: Count To Boolean

rnowitzki — Thu, 25 Jun 2020 08:52:27 GMT

You could either change "count" directly with the eval:

| eval count = if(count=1, "true", "false")

or you remove "count" after you evaled "countflag" (or any other fieldname of your choice)

| fields - count

Re: Count To Boolean

to4kawa — Thu, 25 Jun 2020 09:33:38 GMT

sample:

| tstats count where index=_internal sourcetype=splunkd by PREFIX("group=") | eval boolean=if(count>1000,1,0) | rename COMMENT as "this is the logic" | eval result=nullif(match(boolean,"1"),"true")