Splunk Search

Count field on specific value using streamstats

bernanda
Explorer

Hi Splunkers,

 

Anyone can help, I need to count field Flag where value is 0.

I've tried using this command " streamstats count(Flag=0) as Results_0 | table Results_0"

But the table is blank.

 

Please advice.

 

Thanks

Labels (1)
Tags (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Do you need to get a streaming count or a total count

| streamstats sum(eval(if(Flag=0,1,0))) as Results_0

You can use streamstats where Results_0 will be a new field added to each row, or if you just want to get a single count of the total where Flag=0, use stats, not streamstats.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Do you need to get a streaming count or a total count

| streamstats sum(eval(if(Flag=0,1,0))) as Results_0

You can use streamstats where Results_0 will be a new field added to each row, or if you just want to get a single count of the total where Flag=0, use stats, not streamstats.

 

bernanda
Explorer

Thanks, it works 😁

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...