Splunk Search
Highlighted

How do divide greater than and less than in splunk?

New Member

I'm trying to divide my query into two parts, D>8000 as X and D<=8000 as Y, so i put it .... my search | eval count(if(D<=8000)) AS Y, count(if(D>8000)) AS X | transpose.................... but its not working. How do I divide it?

Tags (2)
0 Karma
Highlighted

Re: How do divide greater than and less than in splunk?

SplunkTrust
SplunkTrust

What does "it's not working" mean? What do you get for X and Y?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How do divide greater than and less than in splunk?

SplunkTrust
SplunkTrust

Hey @sagar1905

Try this

.... my search | eval divide=case(D<=8000,”Y”,D>8000,”X”) | stats count by divide

Let me know if this helps!

0 Karma
Highlighted

Re: How do divide greater than and less than in splunk?

New Member

Hey @mayurr98, it didn't work.
I got the following error
Error in 'eval' command: The expression is malformed. An unexpected character is reached at '”Y”,D>8000,”X”)'.

0 Karma
Highlighted

Re: How do divide greater than and less than in splunk?

SplunkTrust
SplunkTrust

Try this
.... my search | eval divide=if(D<=8000,”Y”,”X”) | stats count by divide

0 Karma
Highlighted

Re: How do divide greater than and less than in splunk?

Super Champion

Do you want these as separate fields or as one field with two values?

To create one field with two values:

...| eval two_parts=if(D<=8000,”Y”,”X”)...

To get separate fields:

...|eval Y=if(D<=8000,D,null())|eval X=if(D>8000,D,null())...
0 Karma
Highlighted

Re: How do divide greater than and less than in splunk?

Champion

The other answers look like they will accomplish what you want, but in terms of the syntax you started with I wonder if you're looking for this:

stats count(eval(D<=8000)) AS Y, count(eval(D>8000)) AS X

View solution in original post

0 Karma
Highlighted

Re: How do divide greater than and less than in splunk?

New Member

Thanks micahkemp, this works. So I should have used eval instead of if.

0 Karma