Splunk Search

Eval eliminated value instead of using NOT in initial search

pepper_seattle
Path Finder

I have a set of data from which I'd like to answer three questions in a single search:
1. Users who open a menu and perform an action
2. Users who open a menu, but perform no action
3. Users who never open the menu

To get results for #2 I need to add a 'NOT' variable to my original search, however I'm hoping that I can actually do it in an eval instead.
Original search:
index=* sourcetype=* NOT clicked
| stats count(opened) by <field>

Note: 'clicked' is a field which unfortunately doesn't contain a 0 or false value

My Question:
I can use a join to get both #1 and #2, but I want to know if there is a way to eval the 'NOT clicked' portion of my search instead of having it eliminate all click values at the start?

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can use the where command in your search to filter results rather than filtering initially. For example: index= sourcetype= | where NOT clicked| stats count(opened) by &lt;field&gt;

---
If this reply helps you, Karma would be appreciated.
0 Karma

pepper_seattle
Path Finder

Using the | where NOT clicked would still require me to use a join to get the data for users that opened the menu and clicked because it's limiting the data. I'm looking for (if possible) something like:
| eval opened_clicked=<?>
| eval opened_notclicked=<?>
| eval not_opened=<?>

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...