How to achieve sum of two fields excluding null fields?

[monicateja]

Hi,

can any one help me how to get splunk query for below requirement.

index="abc"
| search "message"="Exit" | search "stepName"=NotifyFlowEnd | search stepName!=""
| search "message"="PAST_TIME_FRAME"
|  chart count by "message"

In message="Exit"  these 2 conditions need to include ----->     | search "stepName"=NotifyFlowEnd | search stepName!=""

Output is to get Sum of  "message"="Exit"  +  "PAST_TIME_FRAME" count

[monicateja]

Thanks for response. Query is working but only getting count values for message=Exit but not for PAST_TIME_FRAME

step.name= NotifyFlowEnd is extra filter for message=Exit and need to remove step.name=“”

[yuanliu]

In that case,

index="abc" (("message"="Exit" "stepName"=NotifyFlowEnd) OR (message="PAST_TIME_FRAME" stepName!=""))
| chart count by "message"

It is much better to explain the problem and data in text even when you illustrate code that you tried.  Also, if the code you tried did not get the desired result, describe the result and explain why it is not desired.  This way, others do not have to guess what you meant in code fragments that do not reflect the actual requirements.

[yuanliu]

index="abc" "message" IN ("Exit", "PAST_TIME_FRAME") "stepName"=NotifyFlowEnd
| chart count by "message"

This should do.  Note that search commands should be combined in the first command as much as possible.  Another thing to note is that if you have stepName=NotifyFlowEnd, stepName !="" would be unnecessary.