Splunk Search

Conditional count on two values in a single field

rmichel876
Engager

I'm attempting to do a conditional count directly in a stats function. I want a list by application / version that displays a count of errors and a count of exceptions. I believe I need a conditional count, however filtering my data in the search will not work for my data.

I have a field Severity which contains Errors,Info,Warnings. Severity=Error includes both Exceptions and stuff we classify as an Error. We have another field ExceptionType which if not null, we know that the Severity=Error is really an exception not just a normal error. I want to count the Errors that are not exceptions, and the Exceptions separately.

search Severity="Error" | eval ErrorSeverity=if(isnotnull(ExceptionType),"Exception","Error") | stats count(ErrorSeverity=Exception) as Exception, count(ErrorSeverity=Error) as Error by Application, Version

The output should look something like this:
Application Version Exception Error
App1 2.2.23 5 3
App1 2.4.23 1 9
App2 1.39.33 29 0
App3 1.39.33 0 54

I should never see both the Error and Exception count = 0, everything should be one or the other since both are classified as Severity="Error"

0 Karma
1 Solution

tiberious726
Path Finder

count() isn't smart enough to do conditional logic, so you need to put your try-hard hat on and do it upstream.

Severity="Error" | eval Exception=if(isnotnull(ExceptionType),"1",null()) | eval Error=if(isnull(ExceptionType),"1",null()) | stats count(Exception) as Exception, count(Error) as Error by Application, Version

View solution in original post

tiberious726
Path Finder

count() isn't smart enough to do conditional logic, so you need to put your try-hard hat on and do it upstream.

Severity="Error" | eval Exception=if(isnotnull(ExceptionType),"1",null()) | eval Error=if(isnull(ExceptionType),"1",null()) | stats count(Exception) as Exception, count(Error) as Error by Application, Version

Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...