Dashboards & Visualizations

How to Count if the condition is true?

JIthesh_Kumar
Explorer

Hi Team,

There are 2 fields added in my search. but it's searching for same value.

But i need a count of result where the search value present in field 1 and 2. 

 

 

Labels (3)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats count(eval(field1==field2)) as count

View solution in original post

0 Karma

wmuselle
Path Finder

depends what you want to do, as mentioned above if fields are equal (the whole field value is what you are searching for)

if not (i.e it is a particular word inside the field) here are some different examples depending what you want to do , the examples contain different functions that achieve more or less the same

assume you are looking for the word World in both fields:
using streamstats and if like:

 

| makeresults count=2
| streamstats c as c
| eval a=if(c==1,"Hello World","Hello Space"), b=if(c==1,"Ugly World","Pretty Space")
| fields - c
| streamstats sum(eval(if(like(a,"%World%"),if(like(b,"%World%"),1,0),0))) as streamstat
 
 
using just stats, here using match regex as a possible comparison tool:
 
| makeresults count=2
| streamstats c as c
| eval a=if(c==1,"Hello World","Hello Space"), b=if(c==1,"Ugly World","Pretty Space")
| fields - c
| stats count(eval(match(a.b,"(World).*(World)"))) as stats_count_word_exists

there are other options but this should get you started
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats count(eval(field1==field2)) as count
0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...