Dashboards & Visualizations

How to Count if the condition is true?

JIthesh_Kumar
Explorer

Hi Team,

There are 2 fields added in my search. but it's searching for same value.

But i need a count of result where the search value present in field 1 and 2. 

 

 

Labels (3)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats count(eval(field1==field2)) as count

View solution in original post

0 Karma

wmuselle
Path Finder

depends what you want to do, as mentioned above if fields are equal (the whole field value is what you are searching for)

if not (i.e it is a particular word inside the field) here are some different examples depending what you want to do , the examples contain different functions that achieve more or less the same

assume you are looking for the word World in both fields:
using streamstats and if like:

 

| makeresults count=2
| streamstats c as c
| eval a=if(c==1,"Hello World","Hello Space"), b=if(c==1,"Ugly World","Pretty Space")
| fields - c
| streamstats sum(eval(if(like(a,"%World%"),if(like(b,"%World%"),1,0),0))) as streamstat
 
 
using just stats, here using match regex as a possible comparison tool:
 
| makeresults count=2
| streamstats c as c
| eval a=if(c==1,"Hello World","Hello Space"), b=if(c==1,"Ugly World","Pretty Space")
| fields - c
| stats count(eval(match(a.b,"(World).*(World)"))) as stats_count_word_exists

there are other options but this should get you started
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats count(eval(field1==field2)) as count
0 Karma
Get Updates on the Splunk Community!

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Community Feedback

We Want to Hear from You! Share Your Feedback on the Splunk Community   The Splunk Community is built for you ...

Manual Instrumentation with Splunk Observability Cloud: Implementing the ...

In our observability journey so far, we've built comprehensive instrumentation for our Worms in Space ...