topic Re: count condition in Splunk Search

count condition

subachu — Tue, 27 Aug 2019 07:15:47 GMT

I'm having trouble writing a search statement that sets the count to 0 when the service is normally.

This is my data example.

name status
A failed
B failed
C failed
A normally
B normally
C normally

Counting with name will also count normally.
I want to count status failed only.

In this case, everything is normally, I want to display 0.

I know this is not correct, but I want to do like this.

|eval A =if((status=failed),count,null)
|stats count as A

I can't think of a conditional statement that counts when the status is failed.

Sukisen1981 — Tue, 27 Aug 2019 12:47:56 GMT

instead of if , use a case
|eval A=case(status=failed,1)
so A has counts only for failed status

mayurr98 — Tue, 27 Aug 2019 14:57:17 GMT

Try this ?

 <your search> | stats count(eval(status="failed")) as failed_count by name

subachu — Wed, 28 Aug 2019 04:13:08 GMT

Thank you for helping.
what do it mean (status=failed,1)?
I thought (status=failed,0).

Sukisen1981 — Wed, 28 Aug 2019 06:48:54 GMT

hi you said 'I want to count status failed only.' hence I made status=failed as 0.
You can assign any value based on your need