Splunk Search

How can I get a count of entries where one value is 0 or greater than 0?

BearMormont
Path Finder

I have a Splunk Query that is returning data, similar to:

ComputerName    NumVulns
Computer1             10
Computer2              0
Computer3             27
Computer4              0
Computer5            100

And I would like to convert that output to a count of machines where NumVulns is 0 or NumVulns is greater than 0. Something like:

ComputerWithVulns - 3
ComputerWithoutVulns - 2

Ultimately I want to put this into a pie chart, but I am new to Splunk and not sure how to proceed. I've read up on eval and count but so far none of my attempts have been successful.

Thanks!

0 Karma
1 Solution

BearMormont
Path Finder

Figured it out myself:

|stats count(eval(NumVulns==0)) AS ComputerWithVulns count(eval(NumVulns>0)) AS ComputerWithoutVulns | transpose

Thanks!

View solution in original post

0 Karma

BearMormont
Path Finder

Figured it out myself:

|stats count(eval(NumVulns==0)) AS ComputerWithVulns count(eval(NumVulns>0)) AS ComputerWithoutVulns | transpose

Thanks!

0 Karma

BearMormont
Path Finder

Figured it out myself.

|stats count(eval(NumVulns==0)) AS ComputerWithVulns count(eval(NumVulns>0)) AS ComputerWithoutVulns | transpose

Thanks!

0 Karma

micahkemp
Champion

Great! You may consider converting this comment to an answer and accepting it so that others may find the answer more easily.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...