Splunk Search

Eval with stats on multiple fields

rangarbus
Path Finder

I am looking for help on stats with eval 

Input Events (each json is a event):

 

{ "app_name": "app1","logEvent": "Received"}
{ "app_name": "app1","logEvent": "Received"}
{ "app_name": "app1","logEvent": "Missing"}
{ "app_name": "app1","logEvent": "Delivered"}
{ "app_name": "app2","logEvent": "Received"}
{ "app_name": "app2","logEvent": "Delivered"}

 

 

My current query is :

 

index=np-dockerlogs sourcetype=sales
| rename log_processed.* as *
| eval logEvent =upper(logEvent) 
| search logEvent IN ("RECEIVED", "DELIVERED", "MISSING")
| stats count by logEvent app_name

 

Current Output:

app1RECEIVED2
app1MISSING1
app1DELIVERED1
app2RECEIVED1
app2DELIVERED 1

 

Output i want to generate is to remove MISSING and subtract the count of Missing from Received.

  • Received = Total Count of Received - Total Count of Missing
  • Delivered = Total Count of Delivered
app1RECEIVED1
app1DELIVERED1
app2RECEIVED1
app2DELIVERED 1

 

Thank you

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index=np-dockerlogs sourcetype=sales
| rename log_processed.* as *
| eval logEvent =upper(logEvent) 
| search logEvent IN ("RECEIVED", "DELIVERED", "MISSING")
| chart count by app_name logEvent
| eval RECEIVED=RECEIVED-MISSING
| table app_name RECEIVED DELIVERED
| untable app_name logEvent count

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
index=np-dockerlogs sourcetype=sales
| rename log_processed.* as *
| eval logEvent =upper(logEvent) 
| search logEvent IN ("RECEIVED", "DELIVERED", "MISSING")
| chart count by app_name logEvent
| eval RECEIVED=RECEIVED-MISSING
| table app_name RECEIVED DELIVERED
| untable app_name logEvent count

rangarbus
Path Finder

Thanks @ITWhisperer 

I am able to see the data on table format for all app_names and logEvents.

But I couldn't get the "count" on the Single value dashboard based on "app_name" and "logEvent" filter condition. 

index=np-dockerlogs sourcetype=sales
| rename log_processed.* as *
| eval logEvent =upper(logEvent) 
| search logEvent IN ("RECEIVED", "DELIVERED", "MISSING")
| chart count by app_name logEvent
| eval RECEIVED=RECEIVED-MISSING
| table app_name RECEIVED DELIVERED
| untable app_name logEvent count
| search app_name=app1 AND logEvent="RECEIVED" 
| stats sum(count) as "RECEIVED"

 

0 Karma

rangarbus
Path Finder

It worked actually. My input had issues which caused the SingleValue to be empty.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...