Knowledge Management

How to count files in which multiple fields meet certain conditions?

fzhao2
Engager

I have a few files. They all have the same columns and look like this:

timestamp           field1    field2
...
1544079360.84132    99
1544079363.52629              98
1544081067.48075              100
1544081377.48521    100
...

I want to count the files that both field1 and field2 reached 100 or above.

I tried:

... | search field1>=100 AND field2>=100

but it didn't work. I believe it's because there were null values.

So I tried filldown:

... | filldown field1, field2

but it's still not working.

I also tried eventstats and no luck. And I don't prefer eventstats as it gets very slow when data is increasing.

Any thoughts? Thank you!

0 Karma

vinod94
Contributor

Hi @fzhao2,

try this...

....|where field1>=100 OR field2>=100 

Worked for me

| makeresults 
| eval field1="99, , ,100" 
| makemv delim="," field1 
| mvexpand field1 
| appendcols 
    [| makeresults 
    | eval field2=", ,98,100, ," 
    | makemv delim="," field2 
    | mvexpand field2] 
|where field1>=100 OR field2>=100
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@fzhao2 ,

You might want an OR instead of AND since you dont have values for both fields at the same time.

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...