Splunk Search

Count To Boolean

sharadrk
Engager

Hi All,

I have a requirement wherein I count a specific log in the last minute. The count is supposed to be 1. 

I need to convert this count to boolean to show in my visualization. Something like, if count = 1 then True else False. 

I need only true or false as output of the query and not with count. 

I'm basically trying to create a application status monitoring! Any pointers?

Regards,

Sharad R K

Labels (1)
Tags (3)
0 Karma
1 Solution

rnowitzki
Builder

You could either change "count" directly with the eval:

| eval count = if(count=1, "true", "false")

or you remove "count" after you evaled "countflag" (or any other fieldname of your choice)

| fields - count

 

--
Karma and/or Solution tagging appreciated.

View solution in original post

0 Karma

to4kawa
Ultra Champion

sample:

| tstats count where index=_internal sourcetype=splunkd by PREFIX("group=")
| eval boolean=if(count>1000,1,0)
| rename COMMENT as "this is the logic"
| eval result=nullif(match(boolean,"1"),"true")
0 Karma

rnowitzki
Builder

Hi @sharadrk ,

Is this what you are looking for?

| eval countflag = if(count=1, "true", "false")


("countflag" can be anything, you could eve overwrite the count field itself.)

It's not really boolean, just the strings "true" or "false". In the Documentation it says "The result of an eval expression cannot be a Boolean." But you should be able to work with that way.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval

--
Karma and/or Solution tagging appreciated.
0 Karma

sharadrk
Engager

But the thing is if I use this concept, I get output in a table with Count and then countflag. 

That is not what I wanted. I just wanted True or False. How can I not show count and only show countflag?

0 Karma

rnowitzki
Builder

You could either change "count" directly with the eval:

| eval count = if(count=1, "true", "false")

or you remove "count" after you evaled "countflag" (or any other fieldname of your choice)

| fields - count

 

--
Karma and/or Solution tagging appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...