topic Re: Count field on specific value using streamstats in Splunk Search

Count field on specific value using streamstats

bernanda — Mon, 15 Mar 2021 09:51:47 GMT

Hi Splunkers,

Anyone can help, I need to count field Flag where value is 0.

I've tried using this command " streamstats count(Flag=0) as Results_0 | table Results_0"

But the table is blank.

Please advice.

Thanks

Re: Count field on specific value using streamstats

bowesmana — Mon, 15 Mar 2021 10:01:05 GMT

Do you need to get a streaming count or a total count

| streamstats sum(eval(if(Flag=0,1,0))) as Results_0

You can use streamstats where Results_0 will be a new field added to each row, or if you just want to get a single count of the total where Flag=0, use stats, not streamstats.

Re: Count field on specific value using streamstats

bernanda — Mon, 15 Mar 2021 10:10:33 GMT

Thanks, it works 😁