topic Re: How to count total row number of non-zero field? in Splunk Search

How to count total row number of non-zero field?

LearningGuy — Mon, 23 Oct 2023 03:17:04 GMT

How to count total row number of non-zero field?
Thank you in advance

Below is the data set:

ip	Vulnerability	Score
ip1	Vuln1	0
ip1	Vuln2	3
ip1	Vuln3	4
ip2	Vuln4	0
ip2	Vuln5	0
ip2	Vuln6	7

| stats count(Vulnerability) as Total_Vuln, countNonZero(Score) as Total_Non_Zero_Vuln by ip
Is there a function similar to countNonZero(Score) to count row number of non-zero field in Splunk?

With my search above, I would like to have the following output:

ip	Total_Vuln	Total_Non_Zero_Vuln
ip1	3	2
ip2	3	1

Re: How to count total row number of non-zero field?

LearningGuy — Mon, 23 Oct 2023 03:23:23 GMT

I think I just figured it out
This search worked when I tried it... Please suggest..... Thanks
| stats count(Vulnerability) as Total_Vuln, count(eval(Score>0)) as Total_Non_Zero_Vuln by ip

Re: How to count total row number of non-zero field?

inventsekar — Mon, 23 Oct 2023 03:47:35 GMT

Yep, thats a valid and nice SPL(the eval(score>0)).

or
the "!=" also should do the trick...

| stats count(eval(score!=0)) as Total_Non_Zero_Vuln by ip

the stats, eval commands give us so many options, very nice!