Compare the field value with its count.

[onthakur]

Team,

I got stats output as below and I need to compare the field value under column "source" with its count.

Ex :- If count of source ABC is 0 and count of source XYZ is 1 then it should print "Missing in Source ABC".
If both are 0 then it should print "Missing in both Source ABC and XYZ".

stats current output :-

transaction_id   source   count
12345                      ABC        0
12345                       XYZ        1

Required table output:-

transaction_id          Status

12345                   Missing in source ABC

[ITWhisperer]

Generally speaking, Splunk is not good at reporting on something that doesn't exist, so if a transaction in not in ABC nor in XYZ, then Splunk doesn't know about it so can't report that it is missing from both - unless you have a list of transactions from somewhere else.

[richgalloway]

Generally, speaking, Splunk processes events one at a time with no concept of "previous" or "next" events.  We can work around that using an aggregation command.  Try this

<<your existing search>>
``` Check if the count for all sources of a transaction_id is zero```
| eventstats sum(count) as tx_count by transaction_id
| eval Status=if(tx_count=0, "Missing in both sources", "Missing in source " + source)
| stats values(Status) as Status by transaction_id