Splunk Search

Conditional count on two values in a single field

Engager

I'm attempting to do a conditional count directly in a stats function. I want a list by application / version that displays a count of errors and a count of exceptions. I believe I need a conditional count, however filtering my data in the search will not work for my data.

I have a field Severity which contains Errors,Info,Warnings. Severity=Error includes both Exceptions and stuff we classify as an Error. We have another field ExceptionType which if not null, we know that the Severity=Error is really an exception not just a normal error. I want to count the Errors that are not exceptions, and the Exceptions separately.

search Severity="Error" | eval ErrorSeverity=if(isnotnull(ExceptionType),"Exception","Error") | stats count(ErrorSeverity=Exception) as Exception, count(ErrorSeverity=Error) as Error by Application, Version

The output should look something like this:
Application Version Exception Error
App1 2.2.23 5 3
App1 2.4.23 1 9
App2 1.39.33 29 0
App3 1.39.33 0 54

I should never see both the Error and Exception count = 0, everything should be one or the other since both are classified as Severity="Error"

0 Karma
1 Solution

Path Finder

count() isn't smart enough to do conditional logic, so you need to put your try-hard hat on and do it upstream.

Severity="Error" | eval Exception=if(isnotnull(ExceptionType),"1",null()) | eval Error=if(isnull(ExceptionType),"1",null()) | stats count(Exception) as Exception, count(Error) as Error by Application, Version

View solution in original post

Path Finder

count() isn't smart enough to do conditional logic, so you need to put your try-hard hat on and do it upstream.

Severity="Error" | eval Exception=if(isnotnull(ExceptionType),"1",null()) | eval Error=if(isnull(ExceptionType),"1",null()) | stats count(Exception) as Exception, count(Error) as Error by Application, Version

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!