Conditional count using tstats

[eranday]

Is it possible to do a conditional count using tstats?
I want to count specific event_type: (count if(event_type = 'xxxxx')) as num_of_x

Thanks in advance

[Kenshiro70]

I posted a somewhat gnarly way to do what you want to do in another answer (link).

Hope this helps.

[mayurr98]

Hey @eranday
The tstats command does not support complex aggregate functions such as ...count(eval('event_type'=="failure"))
This is mentioned in this official doc
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats#Complex_aggregate_function...

If you want to use then separate out the aggregate functions from the eval functions, as shown in the following search.

| tstats count FROM ..<your_basequery> | stats count(eval(event_type="xxxxx")) as num_of_x

let me know if this helps !

[eranday]

thanks 🙂

[somesoni2 · Accepted solution]

Short answer is no. The complex aggregation command like yours are not supported by tstats. See this for more information
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Tstats#Complex_aggregate_func...

If the field that you're planning to use in your complex aggregation is an indexed field (then only it's available to tstats command), you can try workaround like this (sample)

| tstats count WHERE index=foo sourcetype=bar (event_type="xxxxx" OR event_type="yyyyy") by field1 field2 event_type
| stats sum(eval(if(event_type="xxxxxx",count,0))) as num_of_x sum(eval(if(event_type="yyyyy",count,0))) as num_of_y by field1 field2

[eranday]

thank you