topic Re: How to get the count of a field WITH values and the count of the same field WITHOUT values in the same search using Hunk? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-of-a-field-WITH-values-and-the-count-of-the/m-p/275667#M83157 <P>Couple of options you could try</P> <PRE><CODE>base search | eval zip=if(LOCATION.postalCode="*", 1, 0) | stats count(eval(zip=1)) as wzip count(eval(zip=0)) as nozip </CODE></PRE> <P>OR </P> <PRE><CODE>base search | stats count(eval(LOCATION.postalCode="*") as zip count as total | eval nozip=total-zip </CODE></PRE> Sat, 12 Dec 2015 15:59:27 GMT sundareshr 2015-12-12T15:59:27Z How to get the count of a field WITH values and the count of the same field WITHOUT values in the same search using Hunk? https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-of-a-field-WITH-values-and-the-count-of-the/m-p/275662#M83152 <P>I'm trying to count the number of occurrences of a field WITH values and the number of the same field WITHOUT values in the same search. I can't seem to return any counts for either eval statement. I am using HUNK.</P> <PRE><CODE>base search | eval zip=(if(NOT LOCATION.postalCode="*",1,0)) | stats sum(zip) as count | eval noZip=(if(LOCATION.postalCode="*",1,0)) | stats sum(noZip) </CODE></PRE> Wed, 09 Dec 2015 17:37:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-of-a-field-WITH-values-and-the-count-of-the/m-p/275662#M83152 pontorito 2015-12-09T17:37:14Z Re: How to get the count of a field WITH values and the count of the same field WITHOUT values in the same search using Hunk? https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-of-a-field-WITH-values-and-the-count-of-the/m-p/275663#M83153 <P>not sure why but it's not displaying correctly but in my query I do have an * between the quotes in both statements</P> Wed, 09 Dec 2015 17:39:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-of-a-field-WITH-values-and-the-count-of-the/m-p/275663#M83153 pontorito 2015-12-09T17:39:17Z Re: How to get the count of a field WITH values and the count of the same field WITHOUT values in the same search using Hunk? https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-of-a-field-WITH-values-and-the-count-of-the/m-p/275664#M83154 <P>I don't have experience with Hunk, but using just core Splunk would something like this work? </P> <PRE><CODE>base search | stats count(LOCATION.postalCode) as countWith count(eval(isnull(LOCATION.postalCode))) as countWithout </CODE></PRE> <P>Alternatively if you need to use your evals and sums, if you move both evals to before the stats you could do both sums in one stats</P> <PRE><CODE>base search | eval zip=... | eval noZip=... | stats sum(zip) as count sum(noZip) </CODE></PRE> Wed, 09 Dec 2015 17:43:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-of-a-field-WITH-values-and-the-count-of-the/m-p/275664#M83154 acharlieh 2015-12-09T17:43:14Z Re: How to get the count of a field WITH values and the count of the same field WITHOUT values in the same search using Hunk? https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-of-a-field-WITH-values-and-the-count-of-the/m-p/275665#M83155 <P>Answers uses markdown for formatting, so without indenting 4 spaces it was intrepreting the <CODE>*</CODE> as markers for italics. but if you indent 4 spaces, it becomes a code block... <A href="https://daringfireball.net/projects/markdown/syntax">https://daringfireball.net/projects/markdown/syntax</A></P> Wed, 09 Dec 2015 17:45:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-of-a-field-WITH-values-and-the-count-of-the/m-p/275665#M83155 acharlieh 2015-12-09T17:45:34Z Re: How to get the count of a field WITH values and the count of the same field WITHOUT values in the same search using Hunk? https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-of-a-field-WITH-values-and-the-count-of-the/m-p/275666#M83156 <P>This is close..except the <BR /> count(eval(isnull(LOCATION.postalCode)))</P> <P>statement still brings in records with the LOCATION.postalCode field. How can I incorporate a WHERE isnull(LOCATION.postalCode) into the eval?</P> Thu, 10 Dec 2015 15:00:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-of-a-field-WITH-values-and-the-count-of-the/m-p/275666#M83156 pontorito 2015-12-10T15:00:57Z Re: How to get the count of a field WITH values and the count of the same field WITHOUT values in the same search using Hunk? https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-of-a-field-WITH-values-and-the-count-of-the/m-p/275667#M83157 <P>Couple of options you could try</P> <PRE><CODE>base search | eval zip=if(LOCATION.postalCode="*", 1, 0) | stats count(eval(zip=1)) as wzip count(eval(zip=0)) as nozip </CODE></PRE> <P>OR </P> <PRE><CODE>base search | stats count(eval(LOCATION.postalCode="*") as zip count as total | eval nozip=total-zip </CODE></PRE> Sat, 12 Dec 2015 15:59:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-of-a-field-WITH-values-and-the-count-of-the/m-p/275667#M83157 sundareshr 2015-12-12T15:59:27Z Re: How to get the count of a field WITH values and the count of the same field WITHOUT values in the same search using Hunk? https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-of-a-field-WITH-values-and-the-count-of-the/m-p/275668#M83158 <P>Try this:</P> <PRE><CODE>base search | stats count AS total, count(eval(isnull(LOCATION.postalCode))) AS noZip | eval Zip = count - noZip </CODE></PRE> Sun, 13 Dec 2015 03:14:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-of-a-field-WITH-values-and-the-count-of-the/m-p/275668#M83158 woodcock 2015-12-13T03:14:21Z