Splunk Search

Conditional count using tstats

eranday
New Member

Is it possible to do a conditional count using tstats?
I want to count specific event_type: (count if(event_type = 'xxxxx')) as num_of_x

Thanks in advance

Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Short answer is no. The complex aggregation command like yours are not supported by tstats. See this for more information
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Tstats#Complex_aggregate_func...

If the field that you're planning to use in your complex aggregation is an indexed field (then only it's available to tstats command), you can try workaround like this (sample)

| tstats count WHERE index=foo sourcetype=bar (event_type="xxxxx" OR event_type="yyyyy") by field1 field2 event_type
| stats sum(eval(if(event_type="xxxxxx",count,0))) as num_of_x sum(eval(if(event_type="yyyyy",count,0))) as num_of_y by field1 field2

View solution in original post

0 Karma

Kenshiro70
Path Finder

I posted a somewhat gnarly way to do what you want to do in another answer (link).

Hope this helps.

0 Karma

mayurr98
Super Champion

Hey @eranday
The tstats command does not support complex aggregate functions such as ...count(eval('event_type'=="failure"))
This is mentioned in this official doc
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats#Complex_aggregate_function...

If you want to use then separate out the aggregate functions from the eval functions, as shown in the following search.

| tstats count FROM ..<your_basequery> | stats count(eval(event_type="xxxxx")) as num_of_x

let me know if this helps !

0 Karma

eranday
New Member

thanks 🙂

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Short answer is no. The complex aggregation command like yours are not supported by tstats. See this for more information
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Tstats#Complex_aggregate_func...

If the field that you're planning to use in your complex aggregation is an indexed field (then only it's available to tstats command), you can try workaround like this (sample)

| tstats count WHERE index=foo sourcetype=bar (event_type="xxxxx" OR event_type="yyyyy") by field1 field2 event_type
| stats sum(eval(if(event_type="xxxxxx",count,0))) as num_of_x sum(eval(if(event_type="yyyyy",count,0))) as num_of_y by field1 field2
0 Karma

eranday
New Member

thank you

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...