Splunk Search
Highlighted

## How do divide greater than and less than in splunk?

New Member

I'm trying to divide my query into two parts, D>8000 as X and D<=8000 as Y, so i put it .... my search | eval count(if(D<=8000)) AS Y, count(if(D>8000)) AS X | transpose.................... but its not working. How do I divide it?

Tags (2)
1 Solution
Highlighted

## Re: How do divide greater than and less than in splunk?

SplunkTrust

What does "it's not working" mean? What do you get for X and Y?

---
If this reply helps you, an upvote would be appreciated.
Highlighted

## Re: How do divide greater than and less than in splunk?

SplunkTrust

Hey @sagar1905

Try this

``````.... my search | eval divide=case(D<=8000,”Y”,D>8000,”X”) | stats count by divide
``````

Let me know if this helps!

Highlighted

## Re: How do divide greater than and less than in splunk?

New Member

Hey @mayurr98, it didn't work.
I got the following error
Error in 'eval' command: The expression is malformed. An unexpected character is reached at '”Y”,D>8000,”X”)'.

Highlighted

## Re: How do divide greater than and less than in splunk?

SplunkTrust

Try this
.... my search | eval divide=if(D<=8000,”Y”,”X”) | stats count by divide

Highlighted

## Re: How do divide greater than and less than in splunk?

Super Champion

Do you want these as separate fields or as one field with two values?

To create one field with two values:

``````...| eval two_parts=if(D<=8000,”Y”,”X”)...
``````

To get separate fields:

``````...|eval Y=if(D<=8000,D,null())|eval X=if(D>8000,D,null())...
``````
Highlighted

## Re: How do divide greater than and less than in splunk?

Champion

The other answers look like they will accomplish what you want, but in terms of the syntax you started with I wonder if you're looking for this:

``````stats count(eval(D<=8000)) AS Y, count(eval(D>8000)) AS X
``````
Highlighted

## Re: How do divide greater than and less than in splunk?

New Member

Thanks micahkemp, this works. So I should have used eval instead of if.