Dashboards & Visualizations

How to Count if the condition is true?

JIthesh_Kumar
Explorer

Hi Team,

There are 2 fields added in my search. but it's searching for same value.

But i need a count of result where the search value present in field 1 and 2. 

 

 

Labels (3)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats count(eval(field1==field2)) as count

View solution in original post

0 Karma

wmuselle
Path Finder

depends what you want to do, as mentioned above if fields are equal (the whole field value is what you are searching for)

if not (i.e it is a particular word inside the field) here are some different examples depending what you want to do , the examples contain different functions that achieve more or less the same

assume you are looking for the word World in both fields:
using streamstats and if like:

 

| makeresults count=2
| streamstats c as c
| eval a=if(c==1,"Hello World","Hello Space"), b=if(c==1,"Ugly World","Pretty Space")
| fields - c
| streamstats sum(eval(if(like(a,"%World%"),if(like(b,"%World%"),1,0),0))) as streamstat
 
 
using just stats, here using match regex as a possible comparison tool:
 
| makeresults count=2
| streamstats c as c
| eval a=if(c==1,"Hello World","Hello Space"), b=if(c==1,"Ugly World","Pretty Space")
| fields - c
| stats count(eval(match(a.b,"(World).*(World)"))) as stats_count_word_exists

there are other options but this should get you started
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats count(eval(field1==field2)) as count
0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...