topic Eval with stats on multiple fields in Splunk Search

Eval with stats on multiple fields

rangarbus — Mon, 10 Jan 2022 22:36:52 GMT

I am looking for help on stats with eval

Input Events (each json is a event):

{ "app_name": "app1","logEvent": "Received"} { "app_name": "app1","logEvent": "Received"} { "app_name": "app1","logEvent": "Missing"} { "app_name": "app1","logEvent": "Delivered"} { "app_name": "app2","logEvent": "Received"} { "app_name": "app2","logEvent": "Delivered"}

My current query is :

index=np-dockerlogs sourcetype=sales | rename log_processed.* as * | eval logEvent =upper(logEvent) | search logEvent IN ("RECEIVED", "DELIVERED", "MISSING") | stats count by logEvent app_name

Current Output:

app1	RECEIVED	2
app1	MISSING	1
app1	DELIVERED	1
app2	RECEIVED	1
app2	DELIVERED	1

Output i want to generate is to remove MISSING and subtract the count of Missing from Received.

Received = Total Count of Received - Total Count of Missing
Delivered = Total Count of Delivered

app1	RECEIVED	1
app1	DELIVERED	1
app2	RECEIVED	1
app2	DELIVERED	1

Thank you

Re: Eval with stats on multiple fields

ITWhisperer — Tue, 11 Jan 2022 00:18:49 GMT

Re: Eval with stats on multiple fields

rangarbus — Tue, 11 Jan 2022 03:14:27 GMT

Thanks @ITWhisperer

I am able to see the data on table format for all app_names and logEvents.

But I couldn't get the "count" on the Single value dashboard based on "app_name" and "logEvent" filter condition.

Re: Eval with stats on multiple fields

rangarbus — Tue, 11 Jan 2022 03:38:40 GMT

It worked actually. My input had issues which caused the SingleValue to be empty.