Splunk Search

Conditional count using tstats

eranday
New Member

Is it possible to do a conditional count using tstats?
I want to count specific event_type: (count if(event_type = 'xxxxx')) as num_of_x

Thanks in advance

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Short answer is no. The complex aggregation command like yours are not supported by tstats. See this for more information
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Tstats#Complex_aggregate_func...

If the field that you're planning to use in your complex aggregation is an indexed field (then only it's available to tstats command), you can try workaround like this (sample)

| tstats count WHERE index=foo sourcetype=bar (event_type="xxxxx" OR event_type="yyyyy") by field1 field2 event_type
| stats sum(eval(if(event_type="xxxxxx",count,0))) as num_of_x sum(eval(if(event_type="yyyyy",count,0))) as num_of_y by field1 field2

View solution in original post

0 Karma

Kenshiro70
Path Finder

I posted a somewhat gnarly way to do what you want to do in another answer (link).

Hope this helps.

0 Karma

mayurr98
Super Champion

Hey @eranday
The tstats command does not support complex aggregate functions such as ...count(eval('event_type'=="failure"))
This is mentioned in this official doc
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats#Complex_aggregate_function...

If you want to use then separate out the aggregate functions from the eval functions, as shown in the following search.

| tstats count FROM ..<your_basequery> | stats count(eval(event_type="xxxxx")) as num_of_x

let me know if this helps !

0 Karma

eranday
New Member

thanks 🙂

0 Karma

somesoni2
Revered Legend

Short answer is no. The complex aggregation command like yours are not supported by tstats. See this for more information
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Tstats#Complex_aggregate_func...

If the field that you're planning to use in your complex aggregation is an indexed field (then only it's available to tstats command), you can try workaround like this (sample)

| tstats count WHERE index=foo sourcetype=bar (event_type="xxxxx" OR event_type="yyyyy") by field1 field2 event_type
| stats sum(eval(if(event_type="xxxxxx",count,0))) as num_of_x sum(eval(if(event_type="yyyyy",count,0))) as num_of_y by field1 field2
0 Karma

eranday
New Member

thank you

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...