Splunk Search

Count field on specific value using streamstats

bernanda
Explorer

Hi Splunkers,

 

Anyone can help, I need to count field Flag where value is 0.

I've tried using this command " streamstats count(Flag=0) as Results_0 | table Results_0"

But the table is blank.

 

Please advice.

 

Thanks

Labels (1)
Tags (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Do you need to get a streaming count or a total count

| streamstats sum(eval(if(Flag=0,1,0))) as Results_0

You can use streamstats where Results_0 will be a new field added to each row, or if you just want to get a single count of the total where Flag=0, use stats, not streamstats.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Do you need to get a streaming count or a total count

| streamstats sum(eval(if(Flag=0,1,0))) as Results_0

You can use streamstats where Results_0 will be a new field added to each row, or if you just want to get a single count of the total where Flag=0, use stats, not streamstats.

 

bernanda
Explorer

Thanks, it works 😁

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...