Splunk Search

How to achieve search that If count is less than 0 change it to 0?

Skysurfer
Explorer

Can someone please help me with this.

 I have looking for a query so that if count is less than 0 change it to 0, otherwise display actual count.

for example, if the count is -23, the result should be count=0 and if the count is 23, the result should be count=23.

Labels (1)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @Skysurfer,

it's hard for me to imagine that a count can be less then zero!

If anyway, you mean a sum called count, you can use an eval like this:

| eval count=if(count>0,count,0)

Ciao.

Giuseppe

View solution in original post

gcusello
Esteemed Legend

Hi @Skysurfer,

it's hard for me to imagine that a count can be less then zero!

If anyway, you mean a sum called count, you can use an eval like this:

| eval count=if(count>0,count,0)

Ciao.

Giuseppe

Skysurfer
Explorer

@gcusello @Thank you, it worked.

Shouldn’t have put it as count as count itself has a different meaning in splunk. It was actually  a field value that I was getting by doing some stats sum.

Ciao

0 Karma

gcusello
Esteemed Legend

Hi @Skysurfer,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...