Discrete count on a condition

[priya777]

Hi Splunk team,
I am trying to run a command below, I need my end output as dc(totalCustomers) and dc(Customers_520Error)

Query:

index=*** event=test |
stats dc(customerId) as totalCustomers|
eval errortype=case(errorCode="520","error_520") |
chart dc(customerId) over errorType

[to4kawa]

index=yours event=test errorCode=520
| stats count by customerId
| eventstats dc(customerId) as totalCustomers

your code:

index=*** event=test 
|stats dc(customerId) as totalCustomers
|eval errortype=case(errorCode="520","error_520") 
|chart dc(customerId) over errorType

1. As you want only errorCode="520",try searching first.
2. eval errortype can't work. After stats, there is not errorCode field
3. chart has display limit. use stats at this case.
4. When you ask the question, please provide sample logs and query.