topic Re: help on tostring function in Splunk Search

help on tostring function

jip31 — Sun, 12 May 2019 05:10:50 GMT

hello

I am doing the distinct count below in my search

| stats dc(host) AS OnlineCount by Code 
| where Code = "Online"
| fields OnlineCount 
| appendpipe 
    [ stats count 
    | where count=0]

But I also need to add text after the distinct count
So I am doing this after the distinct count but I have nothing

| eval dc = if(dc== 0, "no host", tostring(dc) + " hosts")

could you help me please??

Re: help on tostring function

Sukisen1981 — Sun, 12 May 2019 07:23:37 GMT

There is no field named dc which you are executing your eval on, try this:
| stats dc(host) AS OnlineCount by info| eval OnlineCount = if(OnlineCount == 0, "no host", tostring(OnlineCount) + " hosts")
| fields OnlineCount

Re: help on tostring function

koshyk — Sun, 12 May 2019 08:00:04 GMT

I think you need to put name as "dc" , instead of variable OnlineCount
Also your code contains a NULL problem for "dc", so i've changed the last field to put value only if the dc >0

|makeresults
| eval hosts="myhost"
| eval Code="Online"
| fields hosts,Code
| stats dc(hosts) AS dc by Code 
 | where Code = "Online"
 | fields dc 
 | appendpipe 
     [ stats count 
     | where count=0]
 | eval dc = if(dc> 0, tostring(dc) + " hosts","no host")

Re: help on tostring function

jip31 — Sun, 12 May 2019 08:39:38 GMT

ok thanks!
I forgotten "as onlinecount"......

Re: help on tostring function

jip31 — Sun, 12 May 2019 08:40:20 GMT

Also thanks to you but I can accept only one answer...

Re: help on tostring function

jip31 — Sun, 12 May 2019 08:40:45 GMT

thanks a lot