Splunk Search

Conditional count using tstats

New Member

Is it possible to do a conditional count using tstats?
I want to count specific event_type: (count if(event_type = 'xxxxx')) as num_of_x

Thanks in advance

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Short answer is no. The complex aggregation command like yours are not supported by tstats. See this for more information
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Tstats#Complex_aggregate_func...

If the field that you're planning to use in your complex aggregation is an indexed field (then only it's available to tstats command), you can try workaround like this (sample)

| tstats count WHERE index=foo sourcetype=bar (event_type="xxxxx" OR event_type="yyyyy") by field1 field2 event_type
| stats sum(eval(if(event_type="xxxxxx",count,0))) as num_of_x sum(eval(if(event_type="yyyyy",count,0))) as num_of_y by field1 field2

View solution in original post

0 Karma

Path Finder

I posted a somewhat gnarly way to do what you want to do in another answer (link).

Hope this helps.

0 Karma

SplunkTrust
SplunkTrust

Hey @eranday
The tstats command does not support complex aggregate functions such as ...count(eval('event_type'=="failure"))
This is mentioned in this official doc
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats#Complex_aggregate_function...

If you want to use then separate out the aggregate functions from the eval functions, as shown in the following search.

| tstats count FROM ..<your_basequery> | stats count(eval(event_type="xxxxx")) as num_of_x

let me know if this helps !

0 Karma

New Member

thanks 🙂

0 Karma

SplunkTrust
SplunkTrust

Short answer is no. The complex aggregation command like yours are not supported by tstats. See this for more information
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Tstats#Complex_aggregate_func...

If the field that you're planning to use in your complex aggregation is an indexed field (then only it's available to tstats command), you can try workaround like this (sample)

| tstats count WHERE index=foo sourcetype=bar (event_type="xxxxx" OR event_type="yyyyy") by field1 field2 event_type
| stats sum(eval(if(event_type="xxxxxx",count,0))) as num_of_x sum(eval(if(event_type="yyyyy",count,0))) as num_of_y by field1 field2

View solution in original post

0 Karma

New Member

thank you

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!