topic How to achieve sum of two fields excluding null fields? in Splunk Search

How to achieve sum of two fields excluding null fields?

monicateja — Mon, 28 Nov 2022 04:33:43 GMT

Hi,

can any one help me how to get splunk query for below requirement.

In message="Exit" these 2 conditions need to include -----> | search "stepName"=NotifyFlowEnd | search stepName!=""

Output is to get Sum of "message"="Exit" + "PAST_TIME_FRAME" count

Re: How to achieve sum of two fields excluding null fields?

yuanliu — Mon, 28 Nov 2022 05:09:42 GMT

index="abc" "message" IN ("Exit", "PAST_TIME_FRAME") "stepName"=NotifyFlowEnd | chart count by "message"

This should do. Note that search commands should be combined in the first command as much as possible. Another thing to note is that if you have stepName=NotifyFlowEnd, stepName !="" would be unnecessary.

Re: How to achieve sum of two fields excluding null fields?

monicateja — Mon, 28 Nov 2022 06:38:14 GMT

Thanks for response. Query is working but only getting count values for message=Exit but not for PAST_TIME_FRAME

step.name= NotifyFlowEnd is extra filter for message=Exit and need to remove step.name=“”

Re: How to achieve sum of two fields excluding null fields?

yuanliu — Mon, 28 Nov 2022 07:17:05 GMT

In that case,

index="abc" (("message"="Exit" "stepName"=NotifyFlowEnd) OR (message="PAST_TIME_FRAME" stepName!="")) | chart count by "message"

It is much better to explain the problem and data in text even when you illustrate code that you tried. Also, if the code you tried did not get the desired result, describe the result and explain why it is not desired. This way, others do not have to guess what you meant in code fragments that do not reflect the actual requirements.