Splunk Search

## How do divide greater than and less than in splunk?

New Member

I'm trying to divide my query into two parts, D>8000 as X and D<=8000 as Y, so i put it .... my search | eval count(if(D<=8000)) AS Y, count(if(D>8000)) AS X | transpose.................... but its not working. How do I divide it?

Tags (2)
1 Solution
Champion

The other answers look like they will accomplish what you want, but in terms of the syntax you started with I wonder if you're looking for this:

``````stats count(eval(D<=8000)) AS Y, count(eval(D>8000)) AS X
``````
Champion

The other answers look like they will accomplish what you want, but in terms of the syntax you started with I wonder if you're looking for this:

``````stats count(eval(D<=8000)) AS Y, count(eval(D>8000)) AS X
``````
New Member

Thanks micahkemp, this works. So I should have used eval instead of if.

Super Champion

Do you want these as separate fields or as one field with two values?

To create one field with two values:

``````...| eval two_parts=if(D<=8000,”Y”,”X”)...
``````

To get separate fields:

``````...|eval Y=if(D<=8000,D,null())|eval X=if(D>8000,D,null())...
``````
Super Champion

Hey @sagar1905

Try this

``````.... my search | eval divide=case(D<=8000,”Y”,D>8000,”X”) | stats count by divide
``````

Let me know if this helps!

New Member

Hey @mayurr98, it didn't work.
I got the following error
Error in 'eval' command: The expression is malformed. An unexpected character is reached at '”Y”,D>8000,”X”)'.

Super Champion

Try this
.... my search | eval divide=if(D<=8000,”Y”,”X”) | stats count by divide

SplunkTrust

What does "it's not working" mean? What do you get for X and Y?

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

#### Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

#### Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

#### Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...