Conditional count on two values in a single field

rmichel876 — Wed, 15 May 2013 16:29:27 GMT

I'm attempting to do a conditional count directly in a stats function. I want a list by application / version that displays a count of errors and a count of exceptions. I believe I need a conditional count, however filtering my data in the search will not work for my data.

I have a field Severity which contains Errors,Info,Warnings. Severity=Error includes both Exceptions and stuff we classify as an Error. We have another field ExceptionType which if not null, we know that the Severity=Error is really an exception not just a normal error. I want to count the Errors that are not exceptions, and the Exceptions separately.

search Severity="Error" | eval ErrorSeverity=if(isnotnull(ExceptionType),"Exception","Error") | stats count(ErrorSeverity=Exception) as Exception, count(ErrorSeverity=Error) as Error by Application, Version

The output should look something like this:
Application Version Exception Error
App1 2.2.23 5 3
App1 2.4.23 1 9
App2 1.39.33 29 0
App3 1.39.33 0 54

I should never see both the Error and Exception count = 0, everything should be one or the other since both are classified as Severity="Error"

Re: Conditional count on two values in a single field

tiberious726 — Wed, 15 May 2013 17:42:18 GMT

count() isn't smart enough to do conditional logic, so you need to put your try-hard hat on and do it upstream.

Severity="Error" | eval Exception=if(isnotnull(ExceptionType),"1",null()) | eval Error=if(isnull(ExceptionType),"1",null()) | stats count(Exception) as Exception, count(Error) as Error by Application, Version

topic Conditional count on two values in a single field in Splunk Search

Conditional count on two values in a single field

Re: Conditional count on two values in a single field