Splunk Search

Count To Boolean

sharadrk
Engager

Hi All,

I have a requirement wherein I count a specific log in the last minute. The count is supposed to be 1. 

I need to convert this count to boolean to show in my visualization. Something like, if count = 1 then True else False. 

I need only true or false as output of the query and not with count. 

I'm basically trying to create a application status monitoring! Any pointers?

Regards,

Sharad R K

Labels (1)
Tags (3)
0 Karma
1 Solution

rnowitzki
Builder

You could either change "count" directly with the eval:

| eval count = if(count=1, "true", "false")

or you remove "count" after you evaled "countflag" (or any other fieldname of your choice)

| fields - count

 

--
Karma and/or Solution tagging appreciated.

View solution in original post

0 Karma

to4kawa
Ultra Champion

sample:

| tstats count where index=_internal sourcetype=splunkd by PREFIX("group=")
| eval boolean=if(count>1000,1,0)
| rename COMMENT as "this is the logic"
| eval result=nullif(match(boolean,"1"),"true")
0 Karma

rnowitzki
Builder

Hi @sharadrk ,

Is this what you are looking for?

| eval countflag = if(count=1, "true", "false")


("countflag" can be anything, you could eve overwrite the count field itself.)

It's not really boolean, just the strings "true" or "false". In the Documentation it says "The result of an eval expression cannot be a Boolean." But you should be able to work with that way.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval

--
Karma and/or Solution tagging appreciated.
0 Karma

sharadrk
Engager

But the thing is if I use this concept, I get output in a table with Count and then countflag. 

That is not what I wanted. I just wanted True or False. How can I not show count and only show countflag?

0 Karma

rnowitzki
Builder

You could either change "count" directly with the eval:

| eval count = if(count=1, "true", "false")

or you remove "count" after you evaled "countflag" (or any other fieldname of your choice)

| fields - count

 

--
Karma and/or Solution tagging appreciated.
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...