Splunk Enterprise

Count of rows with a value greater than 0

3666142
Path Finder

How do a get a count of rows that have a value greater than 0? Example below. The last column is what we are trying to generate.

Name    2024-02-06  2024-02-08    2024-02-13  2024-02-15     Count_Of_Rows_with_Data
Pablo       1          0              1          0               2
Eli         0          0              0          0               0
Jenna       1          0              0          0               1
Chad        1          0              5          0               2

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval Count_Of_Rows_With_Data=0
| foreach 20*
    [| eval Count_Of_Rows_With_Data=if('<<FIELD>>' > 0, Count_Of_Rows_With_Data+1, Count_Of_Rows_With_Data)]

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Alternatively, without having to know the names of the fields

| untable Name Date value
| appendpipe
    [| stats count(eval(value > 0)) as value by Name
    | eval Date="Count_Of_Rows_With_Data"]
| xyseries Name Date value
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval Count_Of_Rows_With_Data=0
| foreach 20*
    [| eval Count_Of_Rows_With_Data=if('<<FIELD>>' > 0, Count_Of_Rows_With_Data+1, Count_Of_Rows_With_Data)]

3666142
Path Finder

Perfect. Thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...