topic Re: Problem with the counting in Splunk Search

Problem with the counting

abhayneilam — Thu, 31 Jan 2013 11:01:19 GMT

Hi,

I have a data like :
Name 1 2 3 4 5

abc 0 2 5 0 18
def 3 0 10 10 11
ghi 0 0 0 7 20

Now, I have 6 columns as "Name" , 1, 2, 3,4,5
I want my output as :

abc 3 ---> 3 becaue there are total of 3 more than 0 number against "abc" name
def 4 ---> 4 becaue there are total of 4 more than 0 number against "def" name
ghi 2 ---> 2 becaue there are total of 2 more than 0 number against "ghi" name

Please help in getting this thing done.

Thanks in advance !!

Re: Problem with the counting

martin_mueller — Thu, 31 Jan 2013 11:29:12 GMT

Here's a thought: Replace every non-zero number with a one, then sum up all columns.

Re: Problem with the counting

abhayneilam — Thu, 31 Jan 2013 11:43:28 GMT

But i dont know my column names in this case, only "Name" column is fixed but not "1","2","3","4","5", these no can changes month to month, Moreover I dont have to summing up the no. I have to get the count for the number which is more than 0

"abc" name is having 2,5 and 18( count is more than 0 ) in the above mentioned details , so against "abc" the total count will be 3

Please help

Re: Problem with the counting

Ayn — Thu, 31 Jan 2013 11:47:04 GMT

Could you please stop ending all your posts with "please help"? 😛

Re: Problem with the counting

martin_mueller — Thu, 31 Jan 2013 17:09:40 GMT

Not knowing the column names is no problem, addtotals will add together a total of all numerical columns.

All you'd have to do for that to work is to get the cells as either 1 or 0.