Dashboards & Visualizations

how to count the field with conditions

Dattasri
Loves-to-Learn

Dattasri_0-1712213665473.png

 

Labels (3)
0 Karma

KothariSurbhi
Loves-to-Learn Everything

Hello @Dattasri ,

You can use the below mentioned search query in which I have used the random function to generate values between 0 and 100, and then applied the `stats count` command.

| makeresults count=10
| eval rand=(random() % 100) + 1
| stats count(eval(rand > 60)) as count_greater_than_60, count(eval(rand < 60)) as count_less_than_60


If this reply helps you, Karma would be appreciated.

Thanks,
Surbhi

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You can use appendpipe command for this - https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Appendpipe

Either creating a temporary fields and counting them (which is a more straightforward solution)

| eval is_small=if(your_field<threshold,1,0)
| eval is_big=if(your_field>another_threshold,1,0)
| appendpipe sum(is_small) as "Small Values" sum(is_big) as "Big Values"

Alternatively to creating temporary fields you can use the eval-based stats like

sum(eval(if(your_field>another_threshold,1,0))) as "Big Values"

But this is more advanced functionality and this syntax can be a bit confusing.

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...