how to count the field with conditions

[Dattasri]

[KothariSurbhi]

Hello @Dattasri ,

You can use the below mentioned search query in which I have used the random function to generate values between 0 and 100, and then applied the `stats count` command.

| makeresults count=10
| eval rand=(random() % 100) + 1
| stats count(eval(rand > 60)) as count_greater_than_60, count(eval(rand < 60)) as count_less_than_60

If this reply helps you, Karma would be appreciated.

Thanks,
Surbhi

[PickleRick]

You can use appendpipe command for this - https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Appendpipe

Either creating a temporary fields and counting them (which is a more straightforward solution)

| eval is_small=if(your_field<threshold,1,0)
| eval is_big=if(your_field>another_threshold,1,0)
| appendpipe sum(is_small) as "Small Values" sum(is_big) as "Big Values"

Alternatively to creating temporary fields you can use the eval-based stats like

sum(eval(if(your_field>another_threshold,1,0))) as "Big Values"

But this is more advanced functionality and this syntax can be a bit confusing.