topic Re: Conditional count using tstats in Splunk Search

Conditional count using tstats

eranday — Tue, 29 Sep 2020 17:44:29 GMT

Is it possible to do a conditional count using tstats?
I want to count specific event_type: (count if(event_type = 'xxxxx')) as num_of_x

Thanks in advance

Re: Conditional count using tstats

somesoni2 — Wed, 17 Jan 2018 17:51:56 GMT

Short answer is no. The complex aggregation command like yours are not supported by tstats. See this for more information
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Tstats#Complex_aggregate_functions

If the field that you're planning to use in your complex aggregation is an indexed field (then only it's available to tstats command), you can try workaround like this (sample)

| tstats count WHERE index=foo sourcetype=bar (event_type="xxxxx" OR event_type="yyyyy") by field1 field2 event_type
| stats sum(eval(if(event_type="xxxxxx",count,0))) as num_of_x sum(eval(if(event_type="yyyyy",count,0))) as num_of_y by field1 field2

Re: Conditional count using tstats

mayurr98 — Wed, 17 Jan 2018 17:59:18 GMT

Hey @eranday
The tstats command does not support complex aggregate functions such as ...count(eval('event_type'=="failure"))
This is mentioned in this official doc
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats#Complex_aggregate_functions

If you want to use then separate out the aggregate functions from the eval functions, as shown in the following search.

| tstats count FROM ..<your_basequery> | stats count(eval(event_type="xxxxx")) as num_of_x

let me know if this helps !

Re: Conditional count using tstats

eranday — Wed, 17 Jan 2018 18:05:42 GMT

thanks 🙂

Re: Conditional count using tstats

eranday — Wed, 17 Jan 2018 18:06:01 GMT

thank you

Re: Conditional count using tstats

Kenshiro70 — Wed, 21 Mar 2018 15:35:11 GMT

I posted a somewhat gnarly way to do what you want to do in another answer (link).

Hope this helps.