https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299373#M90227 <P>Is this related to the Regex IDS app?</P> Tue, 20 Feb 2018 11:13:54 GMT martin_mueller 2018-02-20T11:13:54Z https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299372#M90226 <P>Hello There,</P> <P>I am trying to get an overall stats for all the logs with a particular sourcetype, however in some sourcetye a particular event is missing from which i am applying a filter, for an example there are 10 (2 where test from my side, 5 success and 3 fail), if i have to filter out test there is only 1 way i.e. by locator now problem is for 'failure' locator does not get fired, hence if I apply a filter to exclude test, I am not getting stats of Failure as well, can anyone please help me how can i get overall stats by only excluding test and getting insights on both Success and fail?</P> <P>below is the script which i am using.</P> <PRE><CODE>sourcetype=book_resptime (locator!="TST*" OR locator!="TEST*") | | stats count(book_success) AS Book, count(eval(book_success=0)) AS BookFail by connector </CODE></PRE> <P>Thanks</P> Tue, 20 Feb 2018 11:10:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299372#M90226 Matinrokz 2018-02-20T11:10:20Z https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299373#M90227 <P>Is this related to the Regex IDS app?</P> Tue, 20 Feb 2018 11:13:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299373#M90227 martin_mueller 2018-02-20T11:13:54Z https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299374#M90228 <P>can you try like:</P> <PRE><CODE>sourcetype=book_resptime (locator!="TST*" OR locator!="TEST*") |fillnull locator value=0| stats count(book_success) AS Book, count(eval(book_success=0)) AS BookFail by connector </CODE></PRE> Tue, 20 Feb 2018 11:18:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299374#M90228 493669 2018-02-20T11:18:41Z https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299375#M90229 <P>Hey Thanks for that, for Bookfail locator will not get fired, so it's not working.</P> Tue, 20 Feb 2018 11:26:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299375#M90229 Matinrokz 2018-02-20T11:26:07Z https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299376#M90230 <P>so by using fillnull you can fill null values...does this solves your issue?</P> Tue, 20 Feb 2018 11:28:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299376#M90230 493669 2018-02-20T11:28:58Z https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299377#M90231 <P>no, it's not working.</P> Tue, 20 Feb 2018 11:30:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299377#M90231 Matinrokz 2018-02-20T11:30:38Z https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299378#M90232 <P>Not exactly, but if regex IDS can help to get that desired answer will install that.</P> Tue, 20 Feb 2018 11:44:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299378#M90232 Matinrokz 2018-02-20T11:44:07Z https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299379#M90233 <P>if there are only 3 values then firstly you can try <CODE>(locator="success" OR locator="fail")</CODE><BR /> then can you provide sample output of events</P> Tue, 20 Feb 2018 11:47:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299379#M90233 493669 2018-02-20T11:47:21Z https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299380#M90234 <P>Please don't tag questions with an app if they're not related to that app.</P> Tue, 20 Feb 2018 11:52:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299380#M90234 martin_mueller 2018-02-20T11:52:46Z https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299381#M90235 <P>Removed the app tag</P> Tue, 20 Feb 2018 12:03:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299381#M90235 Matinrokz 2018-02-20T12:03:59Z https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299382#M90236 <P>Thank you!</P> Tue, 20 Feb 2018 12:21:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-overall-stats-if-in-a-single-log-a-particular-event/m-p/299382#M90236 martin_mueller 2018-02-20T12:21:22Z