Splunk Search

Eval with stats on multiple fields

rangarbus
Path Finder

I am looking for help on stats with eval 

Input Events (each json is a event):

 

{ "app_name": "app1","logEvent": "Received"}
{ "app_name": "app1","logEvent": "Received"}
{ "app_name": "app1","logEvent": "Missing"}
{ "app_name": "app1","logEvent": "Delivered"}
{ "app_name": "app2","logEvent": "Received"}
{ "app_name": "app2","logEvent": "Delivered"}

 

 

My current query is :

 

index=np-dockerlogs sourcetype=sales
| rename log_processed.* as *
| eval logEvent =upper(logEvent) 
| search logEvent IN ("RECEIVED", "DELIVERED", "MISSING")
| stats count by logEvent app_name

 

Current Output:

app1RECEIVED2
app1MISSING1
app1DELIVERED1
app2RECEIVED1
app2DELIVERED 1

 

Output i want to generate is to remove MISSING and subtract the count of Missing from Received.

  • Received = Total Count of Received - Total Count of Missing
  • Delivered = Total Count of Delivered
app1RECEIVED1
app1DELIVERED1
app2RECEIVED1
app2DELIVERED 1

 

Thank you

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index=np-dockerlogs sourcetype=sales
| rename log_processed.* as *
| eval logEvent =upper(logEvent) 
| search logEvent IN ("RECEIVED", "DELIVERED", "MISSING")
| chart count by app_name logEvent
| eval RECEIVED=RECEIVED-MISSING
| table app_name RECEIVED DELIVERED
| untable app_name logEvent count

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
index=np-dockerlogs sourcetype=sales
| rename log_processed.* as *
| eval logEvent =upper(logEvent) 
| search logEvent IN ("RECEIVED", "DELIVERED", "MISSING")
| chart count by app_name logEvent
| eval RECEIVED=RECEIVED-MISSING
| table app_name RECEIVED DELIVERED
| untable app_name logEvent count

rangarbus
Path Finder

Thanks @ITWhisperer 

I am able to see the data on table format for all app_names and logEvents.

But I couldn't get the "count" on the Single value dashboard based on "app_name" and "logEvent" filter condition. 

index=np-dockerlogs sourcetype=sales
| rename log_processed.* as *
| eval logEvent =upper(logEvent) 
| search logEvent IN ("RECEIVED", "DELIVERED", "MISSING")
| chart count by app_name logEvent
| eval RECEIVED=RECEIVED-MISSING
| table app_name RECEIVED DELIVERED
| untable app_name logEvent count
| search app_name=app1 AND logEvent="RECEIVED" 
| stats sum(count) as "RECEIVED"

 

0 Karma

rangarbus
Path Finder

It worked actually. My input had issues which caused the SingleValue to be empty.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...