Splunk Search

Count To Boolean

Engager

Hi All,

I have a requirement wherein I count a specific log in the last minute. The count is supposed to be 1. 

I need to convert this count to boolean to show in my visualization. Something like, if count = 1 then True else False. 

I need only true or false as output of the query and not with count. 

I'm basically trying to create a application status monitoring! Any pointers?

Regards,

Sharad R K

Labels (1)
Tags (3)
0 Karma
1 Solution

Builder

You could either change "count" directly with the eval:

| eval count = if(count=1, "true", "false")

or you remove "count" after you evaled "countflag" (or any other fieldname of your choice)

| fields - count

 

--
Karma and/or Solution tagging appreciated.

View solution in original post

0 Karma

Ultra Champion

sample:

| tstats count where index=_internal sourcetype=splunkd by PREFIX("group=")
| eval boolean=if(count>1000,1,0)
| rename COMMENT as "this is the logic"
| eval result=nullif(match(boolean,"1"),"true")
0 Karma

Builder

Hi @sharadrk ,

Is this what you are looking for?

| eval countflag = if(count=1, "true", "false")


("countflag" can be anything, you could eve overwrite the count field itself.)

It's not really boolean, just the strings "true" or "false". In the Documentation it says "The result of an eval expression cannot be a Boolean." But you should be able to work with that way.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval

--
Karma and/or Solution tagging appreciated.
0 Karma

Engager

But the thing is if I use this concept, I get output in a table with Count and then countflag. 

That is not what I wanted. I just wanted True or False. How can I not show count and only show countflag?

0 Karma

Builder

You could either change "count" directly with the eval:

| eval count = if(count=1, "true", "false")

or you remove "count" after you evaled "countflag" (or any other fieldname of your choice)

| fields - count

 

--
Karma and/or Solution tagging appreciated.

View solution in original post

0 Karma