topic Re: not getting empty row value count when doing count by fields. in Splunk Search

not getting empty row value count when doing count by fields.

satishachary199 — Thu, 14 Jun 2018 17:50:03 GMT

i have four filed in a csv file, where some time , one filed value coming as empty, as like below
field1 , field2, field3, field4
DBW DCAR XTY XXS
DBW DCAR XTY XXF
LG DPORT XXS
LG DPORT XTY XXF

Like ,above data when i am doing "count by field1,field2,field3,field4 " not getting the count of empty value.

Thanks in Advance

Re: not getting empty row value count when doing count by fields.

somesoni2 — Thu, 14 Jun 2018 19:32:30 GMT

If any of the field used in by clause of stats command is null, the whole row is dropped. What type of stats you want to do? I believe you'd need to use fillnull before stats to replace null value with some string e.g. N/A, and then do the stats so that you'd get count for all combinations.

Re: not getting empty row value count when doing count by fields.

satishachary199 — Sat, 16 Jun 2018 03:35:02 GMT

thank you , followed the same , got solution.

Re: not getting empty row value count when doing count by fields.

Williammbrooks — Sat, 16 Jun 2018 06:20:14 GMT

We can specify columns we want to calculate in two ways:
COUNT(*) will count all rows in all the columns. The result will be taken from the column that has the highest result.
COUNT(FIELD_NAME) that will calculate the row for a particular field (column).
Furthermore, we can use the COUNT function with or without the DISTINCT clause:
COUNT to count all the rows even if there are duplications of data.
COUNT( DISTINCT ...) to calculate unique rows (rows with same values will not be counted). You can visit my site for more details.